The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from Git diffs and file versions, which could contain malicious instructions meant to manipulate the agent's logic during conflict resolution.
Ingestion points: File contents accessed via git show, conflict markers in git diff, and branch commit logs (SKILL.md).
Boundary markers: There are no delimiters or specific instructions for the agent to treat the ingested code as potentially malicious data rather than instructions.
Capability inventory: The skill utilizes git for network synchronization, file staging, and committing changes (SKILL.md).
Sanitization: No sanitization or validation is performed on the code content before it is analyzed by the agent.
[COMMAND_EXECUTION]: The skill executes shell commands to interact with the local Git environment and manages data using predictable temporary files.
Evidence: The skill uses git subcommands, shell pipes (sed, tee), and writes file lists to fixed paths like /tmp/conflicted.txt (SKILL.md).
Risk Factor: The use of command substitution in git commit -m "... $(cat /tmp/conflicted.txt)" could potentially lead to unexpected shell execution if an attacker manages to introduce malicious filenames containing shell metacharacters into the repository.

resolve-conflicts