The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it ingests untrusted content from git diff without employing boundary markers or instructions to ignore embedded commands.
Ingestion points: SKILL.md (via shell execution of git diff main...HEAD).
Boundary markers: Absent; there are no delimiters or warnings to treat the diff content as untrusted data.
Capability inventory: The skill possesses significant capabilities including local filesystem modification (Write, Edit, Read tools), directory listing (ls), and network operations via git push.
Sanitization: No sanitization or filtering is performed on the code content before it is processed by the agent.
[COMMAND_EXECUTION]: The skill executes multiple shell commands to interact with git and the filesystem. It includes an automated git push command to synchronize the local Obsidian vault with its remote origin. While this is part of the skill's stated functionality, automated push operations on user repositories carry a risk of unintended data transmission if the repository configuration is modified or if branch names are manipulated to interfere with command strings.

ai-code-review