The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources like git log, existing repository files, and PR comments to generate hand-off documentation. Since this documentation is intended to be read and followed by the agent in future sessions, it creates a potential surface for indirect prompt injection. A malicious actor who can commit code or comments to the repository could include instructions designed to hijack the agent's behavior when it later processes the hand-off doc.
Ingestion points: git log, repository files, PR comments, and issues.
Boundary markers: Absent; the skill does not instruct the agent to use delimiters or ignore instructions embedded within the source data.
Capability inventory: The agent has the ability to read/write files and execute git commands.
Sanitization: No sanitization or validation of the ingested content is performed before interpolation into the document.
[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands such as git status, git log, and build/test commands to verify the current state of the project. These are standard developer operations and do not represent a high risk in the context of a development skill, but they do involve execution based on potentially attacker-influenced repository state.

handoff-doc