The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill reads external, potentially untrusted data to inform its actions, creating a surface for indirect prompt injection.
Ingestion points: The agent reads package.json (specifically scripts.check), git status, git diff, and git log -5.
Boundary markers: No explicit boundary markers or instructions to ignore embedded commands in the ingested data are defined.
Capability inventory: The skill can execute shell commands (bun run, git commit, git status, git diff, git log) and write to the file system through linting/formatting tools.
Sanitization: There is no evidence of sanitization or filtering of the content read from the repository metadata or history before it is used to generate commit messages or decide on action paths.
[COMMAND_EXECUTION]: The skill executes arbitrary commands defined in the project's configuration files.
Evidence: It explicitly instructs the agent to run bun run check and bun run e2e based on script definitions found in the project's package.json. If a repository contains a malicious package.json, the agent will execute those commands in the user's environment.

finish-work