The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because its core function involves ingesting and processing untrusted external data from codebases and MicroPatch specification files.
Ingestion points: The agent reads codebase content (via git log, git diff, and direct file access) and micropatch.md files (found in references/apply.md and references/create.md).
Boundary markers: There are no instructions defining delimiters or explicit 'ignore' warnings for content within the ingested files.
Capability inventory: The agent has the capability to read/write files and execute shell commands (e.g., tests, API checks) as specified in the instructions.
Sanitization: There is no mention of sanitizing or validating external content before it is processed or used to influence agent decisions.
[COMMAND_EXECUTION]: The skill instructs the agent to execute arbitrary verification checks defined in a patch's 'Definition of Done'.
Evidence: In references/apply.md, the workflow explicitly tells the agent to 'Run the listed checks whenever possible: tests, commands, API checks, behavior checks, manual validation'. This allows user-provided (or attacker-provided in a malicious patch) commands to be executed in the environment.

micropatch