The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from git commit logs, diff outputs, and external specification files. This content is interpolated directly into prompts for sub-agents without explicit isolation.
Ingestion points: Git diff output, commit messages via git log, and specification files located in docs/, specs/, or .scratch/.
Boundary markers: Absent; instructions do not specify using delimiters or XML tags to encapsulate the external data passed to sub-agents.
Capability inventory: Execution of shell commands via git and spawning of sub-agent processes.
Sanitization: No explicit sanitization or content filtering is implemented for the ingested text.
[COMMAND_EXECUTION]: The skill accepts a user-provided string for the git 'fixed point' and incorporates it directly into shell commands. This creates a potential command injection vector if the input is not strictly validated as a git reference.
Evidence: The skill instructions specify executing git diff <fixed-point>...HEAD and git log <fixed-point>..HEAD based on user input.

code-review