The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8) as it is designed to ingest and act upon untrusted external data.
Ingestion points: The skill reads pull requests (PRs), changelogs, release notes, and source code (SKILL.md Step 3; references/audit-checklist.md 'Sources to check').
Boundary markers: There are no explicit instructions or delimiters defined to prevent the agent from following malicious instructions embedded within the PR descriptions or code comments it reviews.
Capability inventory: The agent has the ability to write to the local filesystem, execute shell commands (blume build, blume validate, and repository-specific lint/format/typecheck scripts), and perform Git operations including branching, committing, and pushing to remote repositories (SKILL.md Steps 2, 4, 5, and 6).
Sanitization: No sanitization or validation logic is specified for the data extracted from PRs or code before it influences the agent's workflow or command execution.
[COMMAND_EXECUTION]: The skill executes local commands which could be manipulated if the repository's configuration is compromised.
Evidence: The workflow instructs the agent to run blume build, blume validate, and any linting or formatting tools specified by the 'repo's conventions' (SKILL.md Step 5). If a malicious PR modifies the project's build or lint scripts, the agent may execute arbitrary code during the verification phase.

blume-update-docs