The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the shell to execute commands including grep, git blame, and the entire binary. It interpolates user-provided inputs—such as file paths, line ranges, and code snippets—directly into these command strings (e.g., grep -n -F -- "<distinctive snippet line>" "<path>"). This pattern relies on the execution environment to properly sanitize inputs to prevent command injection.
[INDIRECT_PROMPT_INJECTION]: The skill ingests, processes, and summarizes data from external and potentially untrusted sources, including local source files, version control history, and checkpoint transcripts. Malicious instructions embedded within code comments, commit summaries, or transcript data could potentially influence the agent's summarization and subsequent response behavior.
Ingestion points: Local file content (Workflow Step 1), git history via git blame (Step 2), and session/checkpoint transcripts via entire checkpoint explain (Step 3).
Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions to isolate untrusted content during summarization.
Capability inventory: The skill possesses capabilities for file system inspection via grep and git, and execution of the entire vendor binary.
Sanitization: No explicit sanitization or validation of the ingested external content is mentioned before it is passed to the LLM for summarization.

what-happened