The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute a shell command (curl) where both the target URL and the message payload are constructed by direct string interpolation (curl -X POST "WEBHOOK_URL" ... -d '{"text": "MESSAGE_HERE"}'). This creates a command injection surface because the message content is derived from untrusted sources like git commit logs and diffs. If the agent fails to perfectly escape shell metacharacters (like single quotes) in the interpolated strings, an attacker who can influence the project's git history could trigger arbitrary command execution on the user's system.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from the local environment that may be influenced by external parties and incorporates it into the agent's context.
Ingestion points: The skill reads git log --oneline -3 and git diff --name-only HEAD~1 (SKILL.md, Step 3).
Boundary markers: The templates (e.g., templates/bugfix.md) lack clear delimiters or instructions to treat the git-sourced data as purely informational, which could allow malicious content in a commit message to influence subsequent agent actions.
Capability inventory: The skill uses curl for network operations, git for repository access, and cat for file reading.
Sanitization: There are no formal sanitization routines defined; the skill relies solely on a natural language instruction to "escape quotes properly" during shell command construction.
[METADATA_POISONING]: There is a discrepancy between the author name provided in the plugin metadata (.claude-plugin/plugin.json lists "Jeremy Dawes") and the expected author context ("ma1orek") provided in the analysis instructions.

google-spaces-updates