The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the agent to resolve a "fixed point" (user-supplied branch name, commit SHA, or tag) by incorporating it directly into shell commands: git rev-parse <fixed-point> and git merge-base <fixed-point> HEAD. A malicious user could provide input containing shell metacharacters (e.g., ;, &&, |, or backticks) to execute arbitrary commands within the agent's operating environment.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the local repository and passes it into the prompts of two parallel sub-agents (Standards and Spec axes).
Ingestion points: The skill captures the complete working-tree change set using git diff and the full contents of all untracked files found via git ls-files --others. It also reads repository documentation like AGENTS.md and CONTRIBUTING.md.
Capability inventory: The skill possesses the ability to execute shell commands (git) and orchestrate multi-agent workflows via the Agent tool.
Boundary markers: The instructions do not specify the use of clear delimiters or "ignore embedded instructions" warnings when interpolating the change-set content or spec files into the sub-agent prompts.
Sanitization: No sanitization, escaping, or validation is performed on the ingested code or documentation content before it is processed by the sub-agents.

code-review