The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from multiple external sources, creating a potential surface for indirect prompt injection attacks where data content could be interpreted as instructions.
Ingestion points: The skill ingests data from git diff outputs, git log commit messages, local specification files (docs/, specs/), and external issue tracker content fetched via a linked workflow.
Boundary markers: The skill instructions do not specify the use of strong boundary markers (such as XML tags or specific delimiters) to isolate untrusted data when passing it to the sub-agent prompts.
Capability inventory: The skill has the capability to execute shell commands (git), read files, and spawn parallel sub-agents with custom instructions.
Sanitization: There is no explicit logic for sanitizing or escaping the content retrieved from the diffs or ticket descriptions before it is interpolated into the prompts for the Standards and Spec sub-agents.
[COMMAND_EXECUTION]: The skill uses shell commands (git rev-parse) to resolve user-supplied inputs such as branch names or tags. While it attempts to resolve these into commit SHAs as a validation step, this pattern presents a potential command injection surface if the inputs are not properly escaped by the execution environment.

code-review