The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it incorporates untrusted content from version control data (diffs, logs, status) into its processing context without protective measures. The instruction to the agent to disregard user-controlled content in prompts as a vulnerability increases the likelihood that malicious directives embedded in the analyzed code will be successfully executed by the agent.
Ingestion points: The SKILL.md file contains placeholders (<git status output>, <list of modified files>, <commit log>, and <full diff>) that are populated with untrusted data from the repository environment.
Boundary markers: The skill fails to use delimiters or explicit "ignore embedded instructions" warnings to separate untrusted data from the agent's operative instructions.
Capability inventory: The SKILL.md instructions direct the agent to use repository exploration and file search tools to investigate the codebase based on the provided diff content.
Sanitization: There is no evidence of sanitization, escaping, or filtering of the external content before it is processed as part of the prompt.

security-review