The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill utilizes the @Git context to ingest repository data, such as diffs, commit history, and file contents, which represents a surface for indirect prompt injection if the repository contains malicious content designed to influence the AI.
Ingestion points: Data enters the context via @Git (Working State), @Git (Branch Diff), and terminal outputs like git show (described in SKILL.md).
Boundary markers: The instructions and examples do not define explicit delimiters or use specific system instructions to ignore potential commands embedded within code diffs or commit messages.
Capability inventory: The skill is granted powerful capabilities including Bash(cmd:*), Read, Write, and Edit tools, which could be misused if an injection is successful.
Sanitization: There is no mention of sanitizing or filtering external Git content before it is processed by the AI.

cursor-git-integration