The Agent Skills Directory

[COMMAND_EXECUTION]: The skill attempts to execute a local script located at $HOME/.config/dotfiles/scripts/canary-scan.sh. This execution is conditional on the file existing and being executable, but it represents the execution of code from outside the skill's own package located in a user-specific configuration directory.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the git working tree, including the full contents of untracked files, and passes this data to sub-agents for analysis.
Ingestion points: Full contents of untracked files are read via cat -n and git diffs are generated within the bash execution steps of SKILL.md.
Boundary markers: The skill uses Markdown headers (e.g., ## Untracked file: [filename]) to separate data sections, but does not provide explicit instructions for the sub-agents to ignore or treat instructions within that data as untrusted content.
Capability inventory: The orchestrator skill utilizes shell commands (bash) to gather data and manage temporary files. The sub-agents are granted the Read tool to examine files in the repository to confirm findings.
Sanitization: There is no evidence of sanitization, filtering, or escaping of the untracked file contents before they are written to the shared input file and read by sub-agents.
[DATA_EXPOSURE]: The skill aggregates the entire change set, including full contents of untracked files, into a single temporary file (.llmtmp/input.md) within the project root. While this file remains local to the project directory, it creates a concentrated repository of potentially sensitive project information that is subsequently processed by multiple agent personas.

review-diff