The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted data from git history and external issue trackers.
Ingestion points: The skill reads output from git diff, git log, and content retrieved from files or trackers defined in docs/agents/issue-tracker.md (SKILL.md, Step 1 & 2).
Boundary markers: Absent. The instructions to the sub-agents in Step 4 do not include delimiters or instructions to treat the diff/spec content as data rather than instructions.
Capability inventory: The skill utilizes git commands, file reading, and agent-spawning capabilities.
Sanitization: There is no evidence of sanitization or filtering for malicious instructions embedded in commit messages or specifications.
[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using unvalidated user input.
Evidence: In Step 1, the instructions state: "Whatever the user said is the fixed point... pass it through" and "Capture the diff command once: git diff <fixed-point>...HEAD". This encourages the direct interpolation of user-supplied strings into a shell command context without validation or sanitization.

review