The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the local environment, including git commit messages (git log), diffs (git diff), and project branch names, to populate message templates. These strings are interpolated directly into the curl command payload. While standard LLM guardrails are in place, there is a risk that malicious commit messages or file content could influence the agent's behavior during message construction.
Ingestion points: Reads git logs, changed files, branch names, and project configuration from .claude/settings.json.
Boundary markers: None explicitly defined in the instructions to separate untrusted data from formatting logic.
Capability inventory: Executes shell commands via curl, git, and cat.
Sanitization: Relies on the user to "escape quotes properly" when constructing the message payload for curl.
[COMMAND_EXECUTION]: The skill uses curl to send data to external webhooks and multiple git commands to gather project context. These are necessary for the skill's primary function but involve executing shell commands based on variable content.
[DATA_EXFILTRATION]: The skill is designed to send project data (commits, diffs, branch names) to a user-provided Google Chat webhook. While this is the intended purpose, it establishes a pattern where project context is routinely sent to an external URL. The instructions correctly advise adding the configuration file to .gitignore to prevent credential exposure.

google-spaces-updates