The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data (file names and diff content) from the local repository via scripts/analyze-diff.py. An attacker could name a file in a way that attempts to influence the agent's behavior or trigger unintended command execution when the agent processes the file list. \n
Ingestion points: The scripts/analyze-diff.py script reads file paths and status information directly from the git working tree via git diff and git ls-files calls in collect_staged, collect_unstaged_tracked, and collect_untracked functions. \n
Boundary markers: The instructions in SKILL.md lack explicit delimiters or instructions to the agent to ignore embedded commands or treating the script's output as potentially malicious content. \n
Capability inventory: The skill requires the agent to use git add and git commit commands, providing a mechanism for the agent to modify the repository based on the analyzed data. \n
Sanitization: There is no evidence of sanitization or escaping of file paths or diff content before they are presented to the agent. \n- [COMMAND_EXECUTION]: The skill uses a helper script, scripts/analyze-diff.py, which executes shell commands via subprocess.run to interact with git. \n
The script uses subprocess.run with hardcoded lists of arguments (e.g., ['git', 'diff', '--staged', '--name-status']), which is a secure pattern for calling external binaries. \n
The agent is instructed to execute git add and git commit based on the output, which are necessary for the skill's primary function but involve the construction and execution of shell commands.

commit-message-generator