The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the $ARGUMENTS variable directly within shell script blocks in SKILL.md. In Step 1, it assigns days="${ARGUMENTS:-7}" and subsequently uses this variable in Step 2 within a subshell: $(date -v-${days}d ...). If the input provided to $ARGUMENTS contains shell metacharacters (e.g., ;, &&, |), it could lead to arbitrary command execution on the host system.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data originating from git commit messages and GitHub pull request metadata, which can be controlled by external contributors.
Ingestion points: git log and gh pr list commands in SKILL.md (Step 2) and references/analysis.md (Steps 4, 6, 7).
Boundary markers: There are no delimiters or explicit instructions provided to the agent to treat the ingested git data as untrusted or to ignore embedded instructions.
Capability inventory: The skill possesses the capability to execute shell commands (git, gh, wc, sed) and perform file system operations (mkdir in Step 14) across both files.
Sanitization: The skill lacks any sanitization, filtering, or validation of the text retrieved from commit logs or PR titles before the Engineering Manager persona analyzes it.

retro