The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides Node.js utility snippets that use child_process.execSync to invoke shell commands like uname and cygpath for environment detection and path conversion.
[DYNAMIC_EXECUTION]: The provided path conversion helpers (toUnixPath and toWindowsPath) dynamically construct shell commands by interpolating variables directly into template literals, such as execSync(cygpath -u "${windowsPath}", ...).
[INDIRECT_PROMPT_INJECTION]: The helper functions in SKILL.md are vulnerable to command injection if used to process untrusted data, such as paths derived from a malicious repository or user-provided strings.
Ingestion points: The windowsPath and unixPath parameters in the helper functions defined in SKILL.md.
Boundary markers: None provided in the code snippets to delimit the shell command from its arguments.
Capability inventory: The skill encourages the use of execSync to bridge shell-specific path differences.
Sanitization: There is no evidence of shell-escaping or validation for the inputs before they are passed to the sub-process.

windows-git-bash-testing