The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted external data, specifically git commit history and CHANGELOG files.
Ingestion points: Data enters the agent context through git log commands and the reading of the project's CHANGELOG.md file (referenced in SKILL.md).
Boundary markers: The instructions do not specify any delimiters or safety markers to differentiate between the agent's instructions and the content of the repository being analyzed.
Capability inventory: The skill uses Bash for git operations and Write for file creation, allowing it to execute commands and persist analysis results to the filesystem.
Sanitization: There is no evidence of sanitization or filtering applied to commit messages or changelog entries before they are processed and incorporated into the output files. An attacker could embed malicious instructions in commit messages or the changelog to influence the agent's summary or behavior.
[COMMAND_EXECUTION]: The skill utilizes the Bash tool to interact with the local filesystem via git commands. While the instructions emphasize 'read-only' operations, the reliance on a shell tool to execute commands based on potentially untrusted repository paths (repo_path) and metadata is a capability that requires oversight.

talk-stage2-research