The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes arbitrary shell commands defined in the project's configuration for code reviews.
Evidence: In references/code-review.md, the instructions state: sh -c "$COMMAND" < "$PROMPT_FILE" > "$REVIEW_OUT", where $COMMAND is the value of code_review.command from the project's config. This allows for arbitrary command injection if the configuration file is compromised.
[DYNAMIC_EXECUTION]: The skill automatically executes a local hook script located within the project repository being processed.
Evidence: In scripts/prepare-worktree.sh, the script checks for the existence of .ai/sift/config/worktree-setup and executes it: SIFT_BASE_COMMIT="$COMMIT" "$HOOK" < /dev/null. This executes repository-provided scripts without prior validation, a significant risk when processing untrusted projects.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from ticket files and project documentation which could contain malicious instructions.
Ingestion points: Reads ticket files from .ai/sift/open/ and .ai/sift/archive/, as well as project READMEs and knowledge entries.
Boundary markers: Uses markdown headings and specific 'Assignment:' block delimiters to separate instructions from data, but these do not prevent adversarial injection.
Capability inventory: The agent has the ability to execute shell commands (via helper scripts), write files to the disk, and perform git operations (commit, branch, worktree).
Sanitization: The read-context.sh script implements bounded reading (8000 bytes) to prevent large-scale context flooding, but no specific sanitization or escaping of prompt-injected instructions is present.

sift-drain