The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from git log (commit messages) and external telemetry APIs (e.g., Cloudflare Workers). This data is incorporated into "intent" files drafted by the agent. A malicious actor could craft commit messages or telemetry responses containing instructions designed to influence the agent's behavior during the drafting phase.\n
Ingestion points: scripts/scan_git_signals.py parses git history, and Tier 2 scans query external telemetry APIs.\n
Boundary markers: The skill instructions provide a markdown template but do not include explicit instructions to ignore or delimit potentially malicious instructions within the ingested source data.\n
Capability inventory: The skill executes local scripts and writes files to the local filesystem (docs/intent/).\n
Sanitization: The provided scripts and instructions do not include mechanisms to sanitize or filter potential injection patterns from commit messages or telemetry data.\n- [COMMAND_EXECUTION]: The script scripts/scan_git_signals.py uses subprocess.run() to execute git commands. While it uses argument lists to mitigate shell injection, it passes user-controllable arguments (such as --repo and --since) from the command line to the underlying system process.

sentinel