The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. It reads the contents of files and unified diffs, which may contain untrusted data, and passes them to a sub-agent dispatched via the Agent tool. A malicious actor could embed instructions within these files to manipulate the sub-agent's behavior or influence the generated suggested_edits.
Ingestion points: File contents and diffs are read using the Read and Bash(git diff) tools in SKILL.md (Workflow Step 3a) and during auto-derive mode (A2 § Per-iter snapshot).
Boundary markers: The skill uses labeled sections such as --- TARGET FILE ---, --- UNIFIED DIFF ---, and --- SCENARIOS --- to separate components of the prompt, providing some structural boundaries.
Capability inventory: The skill has the capability to modify the filesystem using the Edit tool and execute restricted git commands using the Bash tool.
Sanitization: No explicit sanitization or escaping of the ingested file content is performed before it is interpolated into the prompt for the sub-agent.
[COMMAND_EXECUTION]: The skill uses the Edit tool to apply code changes suggested by a sub-agent. This allows for automated, multi-iteration modification of the codebase based on LLM-generated content. Additionally, it utilizes the Bash tool to run git diff and git checkout commands to capture changes and enforce scope restrictions.

verify-diff