The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data (e.g., commit messages, PR numbers, artifact paths) into a TSV log file. While it attempts to neutralize spreadsheet formula injection, the instructions include a 'Cross-model review' phase where a subagent reads the transcript and the log. This creates an attack surface where malicious content embedded in the evidence (like a PR body or file content) could influence the subagent's audit.
Ingestion points: scripts/log.sh accepts external evidence and results; SKILL.md instructs agents to read transcripts in agent-transcripts/.
Boundary markers: The skill advises using plain language and concrete actions but lacks explicit markers to differentiate between audit instructions and log content during the cross-model review.
Capability inventory: The skill uses shell execution (printf, mkdir, tr) and file writes to maintain the log.
Sanitization: scripts/log.sh cleans tabs/newlines and prefixes spreadsheet formula triggers (=, +, -, @) with a single quote, which is a good practice for preventing CSV/TSV injection, but doesn't prevent NLP-level prompt injection.
[COMMAND_EXECUTION]: The logging script scripts/log.sh uses shell variables directly in printf and mkdir. While the script attempts to clean inputs in the clean() function, the $logfile argument and the initial script arguments are used before sanitization, posing a potential command injection risk if the calling agent provides malformed paths or names.
Evidence: logfile="$1", logdir="$(dirname "$logfile")", and mkdir -p "$logdir" in scripts/log.sh.

show-me-your-work