The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and acts upon untrusted data from various sources to determine the "intent" of code changes during conflict resolution.
Ingestion points: Untrusted data enters the agent's context through Git commit messages, pull/merge request descriptions, issue trackers, and local repository documentation (references/resolve-conflicts.md, SKILL.md).
Boundary markers: There are no explicit delimiters or instructions provided to the agent to treat information from these sources as data rather than instructions, potentially allowing embedded malicious commands to influence the agent's logic.
Capability inventory: The skill has significant capabilities, including executing shell commands (Git), installing software dependencies, running test suites, and pushing code to remote repositories with force-with-lease permissions (SKILL.md, references/branch.md).
Sanitization: The skill lacks any sanitization or validation of the content extracted from commit messages or tracker descriptions before it is used to guide conflict resolution decisions.
[DYNAMIC_EXECUTION]: The skill is instructed to discover and run "relevant checks" and "install dependencies" directly from repository instructions and configuration files found within the target codebase (references/branch.md).
This behavior constitutes dynamic code execution where the agent executes scripts or commands defined by the repository being processed. If the repository contains malicious configuration (e.g., a poisoned test script or dependency file), the agent will execute it locally within the checkout environment.
[COMMAND_EXECUTION]: The skill utilizes powerful Git commands to manipulate the repository state, including git worktree add, git update-ref, and git push --force-with-lease (SKILL.md).
While these commands are necessary for the skill's primary function of rebasing and updating branches, their execution is triggered by logic that is susceptible to manipulation via indirect prompt injection from the repository's history.

rebase