The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests user input through the $ARGUMENTS variable and passes it directly to the gitflow-finish-pipeline.md workflow without explicit sanitization or boundary markers.
Ingestion points: User-supplied arguments are captured at the skill invocation level in SKILL.md and passed to the agent.
Boundary markers: The workflow definition lacks specific delimiters or "ignore embedded instructions" warnings for the interpolated $ARGUMENTS.
Capability inventory: The skill has access to Bash(git:*), Read, and Write tools, which could be misused if the user-supplied arguments contain malicious instructions that the downstream agent obeys.
Sanitization: There is no evidence of validation or filtering for the input provided in the command arguments.

finish-feature