The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Bash(git *) tool to execute shell commands. It specifically utilizes git status, git diff, git add, git reset, git commit, and git push. The use of the wildcard * in the allowed tools provides a broad surface for command execution within the git CLI.
[INDIRECT_PROMPT_INJECTION]: The skill has a defined surface for indirect prompt injection by design. It is instructed to read project-level context and rules which override its own base instructions.
Ingestion points: The skill reads content from .ai-factory/config.yaml, .ai-factory/skill-context/aif-commit/SKILL.md, and various plan files (e.g., .ai-factory/PLAN.md, phase files).
Boundary markers: There are no explicit delimiters or instructions provided to the agent to treat the content of these external files as untrusted data or to ignore embedded instructions.
Capability inventory: The skill possesses significant capabilities, including reading files, listing files via globbing, and executing git commands that can modify the repository state or push changes to remote servers.
Sanitization: The skill explicitly states that project-level rules ('skill-context') should 'win' and take priority over general instructions, even if they contradict defaults. This lacks sanitization or validation of the instructions provided in those files, creating a vulnerability if the files are modified by an attacker.

aif-commit