The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection attack surface because it is designed to ingest untrusted data while holding shell and file modification capabilities.
Ingestion points: In commands/fact-check.md, commands/plan-review.md, and commands/diff-review.md, the skill ingests external user files, markdown RFC documents, git commit histories, and pull request diffs.
Boundary markers: The instruction templates lack clear encapsulation markers or guardrails directing the model to ignore embedded or malicious prompts within the text being audited.
Capability inventory: The skill possesses capabilities to execute shell commands, perform in-place text corrections on local files (commands/fact-check.md), and run automation scripts (scripts/share.sh).
Sanitization: No input validation, escaping, or structural filtering is implemented on external data sources prior to their inclusion in the agent context.
[COMMAND_EXECUTION]: The skill routinely invokes shell utilities and script components as part of its diagnostic and rendering workflows.
The markdown files under commands/ direct the agent to execute tools including git diff, git log, grep, wc, and surf to compile fact sheets and dashboards.
The shell script scripts/share.sh dynamically locates and executes an external peer skill's script (deploy.sh) to copy files and publish them to a hosting provider.

visual-explainer