The Agent Skills Directory

[PROMPT_INJECTION]: The skill presents an indirect prompt injection surface because it ingests and processes untrusted data from git diffs, commit logs, and external spec sources (via issue tracker documentation) which is then passed to sub-agents as part of their instructions.
Ingestion points: Git diff output, git log output, and content fetched via instructions in docs/agents/issue-tracker.md.
Boundary markers: The prompts for the 'Standards' and 'Spec' sub-agents do not specify any delimiters (like xml tags or triple quotes) or warnings to ignore instructions that might be embedded within the code diffs or spec content.
Capability inventory: The skill uses git command-line tools and the Agent tool to delegate analysis.
Sanitization: There is no evidence of data sanitization, escaping, or validation of the external content before interpolation into sub-agent prompts.
[COMMAND_EXECUTION]: The skill constructs and executes shell-based commands (git diff, git log, git rev-parse) using a user-supplied reference point (<fixed-point>). While core to its functionality, this creates a potential command injection vector if the platform does not properly sanitize or escape the user-provided input before shell execution.

review