The Agent Skills Directory

[COMMAND_EXECUTION]: The skill constructs shell commands by interpolating variables directly into a command string, which is a known pattern for command injection vulnerabilities.
Evidence: In SKILL.md, steps 2 and 3 instruct the agent to execute git-agent commit --intent "<intent>" --co-author "<model> <noreply@anthropic.com>".
Risk: If the intent derived from the conversation or the model name provided in arguments contains shell metacharacters like semicolons, backticks, or command substitution syntax, it could lead to arbitrary code execution in the shell environment.
[PROMPT_INJECTION]: The skill processes untrusted conversation data to generate command arguments, creating an indirect prompt injection surface.
Ingestion points: User conversation is used to "Derive a one-sentence intent" (SKILL.md).
Boundary markers: None. There are no instructions to the agent to treat the conversation as untrusted data or to ignore instructions embedded within it.
Capability inventory: The skill uses the Bash tool to execute git-agent and git commands.
Sanitization: Absent. There are no instructions to sanitize, escape, or validate the derived intent or model name before they are interpolated into the bash command.

commit