The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from Git commit history and the docs/user-changelog.md file to determine the scope of changes and generate summaries. An attacker with the ability to commit to the repository could craft messages or modify the changelog file to influence the agent.
Ingestion points: Git commit subjects and bodies retrieved via git log, and the SHA boundary string extracted from the project's docs/user-changelog.md file using grep and sed.
Boundary markers: The instructions do not define clear boundaries or 'ignore' directives to prevent the agent from following instructions embedded within the commit messages or documentation headings.
Capability inventory: The skill performs file reads, shell command execution (git, grep, sed), and file writes. It also references a workflow that executes bun run check.
Sanitization: There is no evidence of sanitization or validation of the data extracted from Git or the documentation file before it is interpolated into shell commands or used as context for the summarization task.

user-changelog