The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process content from a git repository, which may include untrusted data from commit messages or the source code itself that could contain malicious instructions.
Ingestion points: The agent retrieves data through git diff, git log, and by reading files within the docs/, specs/, or .scratch/ directories as specified in the SKILL.md process.
Boundary markers: Absent. The instructions do not define clear delimiters or include 'ignore embedded instructions' warnings for the sub-agents processing the diff and specification content.
Capability inventory: The skill's operations are limited to read-only git commands (git diff, git log, git rev-parse) and repository file access. It does not contain capabilities for network requests or writing to the file system.
Sanitization: Absent. The retrieved git output and specification text are interpolated directly into the prompts for the parallel sub-agents without sanitization or validation.

code-review