The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill dynamically selects a delivery tool based on input provided in the user prompt (e.g., 'Deliver through the tool the prompt names'). While it provides SaveCommitMessage as an example, the instructions allow the agent to attempt to invoke any tool named by the user that is 'available in the session'. This creates a risk of sensitive data redirection if a malicious user specifies a tool with similar parameters but unintended side effects.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests untrusted data from external sources including CRM Project Tasks, Support Cases, and Azure DevOps work items (Phase 3 and Phase 4).
Ingestion points: External ticket descriptions and requirements are fetched using dxs crm and dxs devops tools (SKILL.md, references/traceability.md).
Boundary markers: The instructions do not define boundary markers or 'ignore' directives to prevent the agent from following malicious instructions that might be embedded in the fetched ticket data.
Capability inventory: The skill has read/write access to CRM via dxs, and can send data externally via SaveCommitMessage or other session tools.
Sanitization: There is no explicit requirement to sanitize or filter external ticket content before processing it.
[COMMAND_EXECUTION]: The skill relies heavily on the dxs CLI tool for reading branch data and updating CRM records. It passes user-supplied branch IDs into these command lines (e.g., dxs source branch show <BRANCH_ID>). While the workflow assumes a valid ID, the instructions do not explicitly mandate input validation or sanitization, which could lead to command injection if the underlying tool or shell environment does not handle arguments safely.
[DATA_EXFILTRATION]: In 'one-shot' mode, the skill is designed to automatically summarize branch changes (including diffs) and transmit them to a delivery tool. While this is the intended functionality, the lack of a restricted tool whitelist for delivery means the agent could be manipulated into exfiltrating this code-related data to an unexpected tool destination.

commit-message-generator