The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external, potentially untrusted data that could contain malicious instructions designed to manipulate the agent's behavior.\n
Ingestion points: Reads output from git diff and git log, as well as content from repository specification files (e.g., in documentation/, specifications/ folders).\n
Boundary markers: The instructions for spawning sub-agents do not specify the use of delimiters or 'ignore' instructions to separate the data from the prompt instructions.\n
Capability inventory: The skill executes git commands and can invoke the publish-review tool to post findings to GitHub, GitLab, or Jira.\n
Sanitization: There is no evidence of sanitization or filtering of the content ingested from diffs or specification files.\n- [COMMAND_EXECUTION]: The skill constructs shell commands using arguments provided by the user.\n
Evidence: The skill uses a user-supplied <fixed-point> in commands like git diff <fixed-point>...HEAD and git rev-parse <fixed-point>.\n
Risk: While the skill includes a check to ensure the reference resolves, a maliciously crafted input could potentially result in command injection if the execution environment does not adequately sanitize shell arguments.\n- [EXTERNAL_DOWNLOADS]: The skill documentation suggests a command to install an external component from a remote repository.\n
Evidence: npx skills@latest add Dyrits/SKILLS --skill=publish-review in SKILL.md.\n
Context: This is a manual instruction for the user to install a related tool from the vendor's own repository (Dyrits/SKILLS). As a vendor-owned resource, this is documented neutrally without escalating the verdict.

code-review