The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon instructions contained within the repositories it manages, which can lead to indirect prompt injection if those files contain malicious content.
Ingestion points: The skill reads AGENTS.md and similar repository instruction files as specified in SKILL.md (Step 1), references/resolving-merge-conflicts.md (Step 1), and references/writing-git-commit-message.md (Step 1).
Boundary markers: There are no explicit delimiters or safety instructions provided to the agent to distinguish between trusted user instructions and untrusted instructions found in the repository data.
Capability inventory: The skill possesses significant capabilities including file modification via git commit, git cherry-pick, and worktree management (git worktree add/move/remove), which could be misused if the agent is influenced by injected content.
Sanitization: The skill lacks mechanisms for sanitizing or filtering the content of the repository-level instruction files before they are processed by the agent.

ptlam-git