The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the repository, including source diffs and instruction files, and executes project-defined check scripts. This creates a surface for indirect prompt injection where malicious content in the repository could influence agent behavior.
Ingestion points: The agent reads source code diffs, repository-level instructions (e.g., .cursorrules or README files), and project check definitions in SKILL.md (Preflight step 4).
Boundary markers: The instructions do not define specific delimiters or "ignore embedded instructions" warnings for data ingested from the repository.
Capability inventory: The skill executes shell commands via git and gh, and runs arbitrary project-specific checks (subprocess execution) (Preflight step 5, Local mode step 4).
Sanitization: The skill explicitly instructs the agent to "refuse unrelated or secret-bearing changes," providing a layer of protection against data exposure, but it lacks specific sanitization for natural language instructions embedded in code or documentation.
[EXTERNAL_DOWNLOADS]: The skill references and loads external logic from a specific repository on GitHub (mattpocock/skills) to handle complex merge conflict resolutions.
[COMMAND_EXECUTION]: The skill executes "project checks" discovered within the repository. While standard for development workflows, this involves running local scripts or binaries (e.g., npm test, make) defined by the project, which constitutes arbitrary command execution relative to the repository content.

merge-worktree