The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute arbitrary commands from the local repository by mandating that it "Run the project's required check suite yourself". This creates a vector where a malicious repository could execute code when a report is requested.
[REMOTE_CODE_EXECUTION]: The instructions require the use of browser automation and the execution of a local web server to verify the report's visual rendering. While tools are used locally, they represent a high-capability execution environment.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface (Category 8) by ingesting untrusted data from repository diffs, source files, and test names to generate report content.
Ingestion points: Data enters the context via git status, staged/unstaged diffs, source code, and test files as described in Step 1 of the workflow in SKILL.md.
Boundary markers: The skill uses structured HTML templates and specific data attributes, but lacks explicit warnings for the raw source code snippets it incorporates beyond basic escaping.
Capability inventory: The skill utilizes git, grep, wc, file write operations to the reports/ directory, local HTTP server startup, and browser automation.
Sanitization: Step 4 in SKILL.md explicitly instructs the agent to escape HTML characters (<, >, &) within snippet markup to mitigate XSS risks in the generated report.

create-changes-report