The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of untrusted data from repository history, including commit messages and diffs, through commands like jj log, jj show, and jj diff.
Ingestion points: Commands such as jj log, jj show, and jj diff (referenced in history.md and references/revsets.md) read content from the repository that may be attacker-controlled.
Boundary markers: Absent. There are no explicit instructions or delimiters used to separate untrusted commit content from the agent's instructions, nor specific warnings to ignore instructions found within that content.
Capability inventory: The skill provides the agent with extensive capabilities to modify the local repository (jj new, jj describe, jj squash, jj rebase) and push changes to remote servers (jj git push), which could be abused if an injection is successful.
Sanitization: Absent. No sanitization or escaping mechanisms are described for handling commit messages or other repository metadata.

jj