The Agent Skills Directory

[DATA_EXFILTRATION]: The skill instructions allow the AI agent to access sibling directories via relative paths (e.g., ../sibling-repo). This enables the agent to read files outside the primary project scope, potentially exposing sensitive information if unauthorized paths are accessed.
[COMMAND_EXECUTION]: The skill uses shell-based commands, specifically git operations such as rev-parse, for-each-ref, and show, to interact with repository references. Executing shell commands with variable path arguments presents a risk of command injection if not properly handled.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted prose files (Markdown, HTML, TXT) to extract values using regular expressions. Maliciously crafted content in these files could influence the facts extracted or the edits proposed by the agent.
Ingestion points: Markdown, HTML, and text files across the repository and sibling repositories.
Boundary markers: None implemented for the primary scanning logic.
Capability inventory: File read/write, shell command execution (git).
Sanitization: Basic trimming and numeric normalization.

ssot-check