The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to construct and execute shell commands (git diff, git log, git rev-parse) using a user-provided string ('fixed-point'). While the skill includes a validation step using git rev-parse before execution, the instruction to 'pass it directly' without additional sanitization or shell-escaping logic creates a potential surface for command injection if the agent's tool execution environment does not automatically handle argument quoting.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data from the local repository and interpolates it into the instructions for its sub-agents.
Ingestion points: Untrusted data enters the agent context via git diff output, commit messages, and external documentation/specification files located in the repository (e.g., docs/, specs/, or .scratch/).
Boundary markers: The instructions in SKILL.md for launching sub-agents do not specify the use of clear delimiters or 'ignore' instructions to prevent the agent from following commands embedded within the diffs or commit messages.
Capability inventory: The skill utilizes git CLI tools and the ability to read and aggregate data from multiple files across the filesystem.
Sanitization: There is no explicit sanitization or filtering of the external content (diff hunks or commit titles) before it is passed to the sub-agent prompts.

code-review