The Agent Skills Directory

Indirect Prompt Injection Surface: The skill ingests untrusted data from external sources, specifically pull request diffs via gh pr diff. If a pull request contains malicious instructions embedded within code comments or documentation text, the agent might accidentally adopt those instructions while planning tasks.
Ingestion points: Pull request diffs ($PR), candidate page contents, and the .apm/docs-index.yml file provide external data to the skill.
Boundary markers: The instructions do not explicitly define boundary markers or sanitization steps to distinguish between legitimate content and potential instructions within the ingested data.
Capability inventory: The skill is capable of executing shell commands (gh pr diff) and generating a list of verification commands (grep, apm install --help) meant for a downstream agent.
Sanitization: There are no explicit sanitization or validation steps for the content extracted from the PR diff before it is used to construct the task brief.
Dynamic Command Composition: In Step 4, the skill generates a verify_claims list containing strings meant to be executed as shell commands (e.g., grep -n no-cache ...). Because these commands incorporate symbols and data directly from the input sources (like the PR diff), there is a potential for command injection if an input contains shell metacharacters.

docs-impact-localizer