The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it ingests and displays untrusted data from the project's git history.
Ingestion points: Commit messages, intent descriptions, and code diffs are read from the git repository and index.yaml via scripts/gcc_context.sh.
Boundary markers: Output is delimited using Markdown headers (e.g., ## [$id]), but it lacks explicit instructions to the agent to ignore potentially malicious content embedded in reconstructed commit messages.
Capability inventory: The skill has the ability to execute shell commands, perform file system operations (rm -rf during cleanup), and communicate with external CLI tools.
Sanitization: While the skill correctly escapes data when writing to YAML or JSON, the content is presented in raw form to the agent during context reconstruction.
[DATA_EXFILTRATION]: The scripts/gcc_bridge.sh script facilitates the transfer of git metadata (hashes, intents, and decision notes) to an external memory store via the aiyoucli command-line tool.
[COMMAND_EXECUTION]: The skill relies on multiple shell scripts that execute system commands including git, awk, sed, and rm -rf. Specifically, scripts/gcc_cleanup.sh performs directory removal based on paths defined in the index.yaml file.
[EXTERNAL_DOWNLOADS]: The documentation references installation via npx skills add, which involves fetching the skill code from a remote source, and the bridge script depends on the external aiyoucli package being present in the system's PATH.

gcc