The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from past AI conversations (the messages field in prompts.db) which creates a surface for indirect prompt injection.
Ingestion points: The agent retrieves conversation content via the git-ai prompts next command in SKILL.md, which returns JSON containing human prompts and AI responses.
Boundary markers: The skill instructions lack robust delimiters or specific instructions to ignore commands embedded within the analyzed conversation data when passing it to subagents.
Capability inventory: The agent and its subagents have access to Bash(git-ai:*) and the Task tool, which can be used to modify the database or spawn further actions based on injected instructions.
Sanitization: No sanitization, filtering, or validation of the conversation content is described before it is processed by the AI.
[COMMAND_EXECUTION]: The skill relies on executing shell commands via the git-ai tool to manage and query its local database.
Evidence: SKILL.md contains numerous examples of git-ai prompts exec being used to perform ALTER TABLE, UPDATE, and complex SELECT operations.
Evidence: The skill uses the Task tool to dynamically spawn subagents with instruction sets generated at runtime.

prompt-analysis