The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is instructed to parse and execute shell commands found in docs/workflow.md and docs/plan//spec.md. This creates a surface where a maliciously crafted project file could lead to arbitrary command execution by the agent. Ingestion points: Integration Testing commands in docs/workflow.md and acceptance criteria commands in docs/plan//spec.md. Boundary markers: There are no explicit delimiters or instructions to treat these extracted strings as untrusted data. Capability inventory: The skill has full access to shell execution via the Bash tool. Sanitization: No validation or escaping is performed on commands extracted from the documentation files before execution.
[COMMAND_EXECUTION]: The skill performs extensive shell command execution as part of its review pipeline, including running test suites (pytest, npm test, swift test), linters (ruff, swiftlint, detekt), build systems, and production log retrievers (vercel, wrangler, ssh, supabase). While these are aligned with the skill's purpose, they provide a broad surface for command-based attacks.
[DYNAMIC_CONTEXT_INJECTION]: The skill uses the !command syntax in SKILL.md to inject live git status information when the skill is loaded. Evidence: !git branch --show-current 2>/dev/null and !git diff --stat HEAD~3..HEAD 2>/dev/null | tail -5. These specific commands are benign and used for project context, but the mechanism allows for load-time execution.

solo-review