The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell-level git commands (e.g., git diff, git log, git rev-parse) using a user-supplied <fixed-point> variable. If the underlying platform does not sanitize these inputs, a malicious user could provide a reference containing shell metacharacters (e.g., ;, &, |) to execute arbitrary system commands.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection by ingesting and processing untrusted data which is then passed to sub-agents.
Ingestion points: Data enters the agent's context through git diff outputs, commit messages, and external specification files found in directories like docs/, specs/, or .scratch/.
Boundary markers: The instructions do not specify the use of delimiters (like XML tags or triple backticks) or provide "ignore instructions" warnings when passing this external data into the sub-agent prompts.
Capability inventory: The skill has the ability to execute git commands and spawn new sub-agents using the Agent tool.
Sanitization: There is no mention of sanitizing, escaping, or validating the content of the diffs or specifications before they are interpolated into prompts.

code-review