The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses user-supplied input to construct shell commands. The <fixed-point> identifier provided by the user is directly interpolated into commands such as git diff <fixed-point>...HEAD, git log <fixed-point>..HEAD, and git rev-parse <fixed-point>. Without proper sanitization or use of safe APIs, a malicious user could provide a string containing shell metacharacters (e.g., ;, &, |) to execute arbitrary commands on the host system.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data from the repository environment and passes it to sub-agents without isolation.
Ingestion points: The skill reads content from git diff, git log, and various specification/documentation files (e.g., CODING_STANDARDS.md, specs/*) which may contain instructions intended to influence the agent's behavior.
Boundary markers: No explicit delimiters or instructions are used to separate the ingested untrusted content from the system instructions provided to the parallel sub-agents.
Capability inventory: The skill possesses the ability to read files, execute git commands, and spawn sub-agents that can process and potentially act upon injected instructions.
Sanitization: There is no evidence of sanitization or validation of the content fetched from files or git history before it is interpolated into the prompts for the sub-agents.

code-review