The Agent Skills Directory

Indirect Prompt Injection Surface: The skill processes git commit messages and diff content, which are essentially untrusted data originating from the repository's history. This represents a potential surface for indirect prompt injection where malicious instructions hidden in a commit or diff could influence an AI agent processing the output.
Ingestion points: The skill retrieves repository data via git log and git diff commands in scripts/generate.sh and scripts/generate.ps1.
Boundary markers: The output is structured using specific XML tags (<commits>, <full_diff>), and commit metadata is wrapped in <![CDATA[...]]> blocks to help agents distinguish content from instructions.
Capability inventory: The skill is capable of executing local git commands and writing the resulting XML output to the file system (e.g., in .copilot-tracking/).
Sanitization: The implementation uses CDATA sections for commit subjects and bodies, which is a recommended practice to ensure text is treated as literal data rather than instructions.

pr-reference