The Agent Skills Directory

[PROMPT_INJECTION]: The instructions use high-pressure imperative language to override standard agent safety protocols. The skill explicitly commands the agent to "immediately execute" and "prohibit asking for confirmation" for actions such as git push, git commit, and git add. This reduces user oversight for sensitive operations.
[COMMAND_EXECUTION]: The skill relies on executing multiple system-level shell commands including git status, git diff, git add ., git commit, git push, and branch management commands like git checkout and git merge.
[DATA_EXFILTRATION]: The workflow involves a broad git add . followed by an unconfirmed git push. This pattern creates a vector for data exfiltration, as any local secrets or sensitive files (e.g., .env, .pem) that are not already in .gitignore could be automatically staged and sent to a remote repository without the user reviewing the specific file list.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface by ingesting untrusted data through git diff output.
Ingestion points: File content and metadata are ingested via git diff and git status in skill.md.
Boundary markers: The instructions lack delimiters or boundary markers to distinguish between code content and the agent's instructions.
Capability inventory: The skill has access to network operations (git push) and file system staging (git add) as documented in skill.md.
Sanitization: There is no evidence of sanitization or escaping of the diff output before the LLM processes it to generate commit messages.

git