The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from external sources (git history and diffs) to generate prose.
Ingestion points: Data enters the agent context via git log and git diff commands executed in SKILL.md (Step 2).
Boundary markers: The skill lacks explicit boundary markers or instructions to the LLM to ignore embedded commands within the diffs or commit messages.
Capability inventory: The agent has access to Write, Edit, and Bash tools across its scripts, which could be exploited if an injection in a diff influences its output or subsequent actions.
Sanitization: While the agent-prompt.md file contains instructions to avoid leaking secrets, it does not include filters or sanitization logic to mitigate prompt injection from the source material.
[COMMAND_EXECUTION]: The skill uses the Bash tool to execute git and gh commands. These are utilized to retrieve repository history and manage pull requests. The usage targets the official GitHub CLI and standard git binary, which are well-known tools.

document