The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to write files directly to the local file system, specifically recommending global locations outside the code repository such as /tmp/. While common for developer tools, this behavior bypasses project-level isolation.
[DYNAMIC_EXECUTION]: The skill generates self-contained HTML files that include custom CSS and JavaScript to enable interactive features like quizzes and diagrams. This script generation constitutes a dynamic execution surface where generated code runs in the user's browser.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data from external sources (diffs, branches, and pull requests) and incorporate it into an interactive report. It lacks sufficient safeguards against malicious content embedded within the code changes it analyzes.
Ingestion points: Reads code changes, diffs, and pull request data which are typically external and potentially attacker-controlled (SKILL.md).
Boundary markers: The instructions do not define clear delimiters or provide the agent with 'ignore embedded instructions' warnings for the input code content.
Capability inventory: The agent has the capability to write the resulting HTML and JavaScript to the local disk, which the user is then intended to open in a browser (SKILL.md).
Sanitization: There are no instructions to sanitize, escape, or validate the content of the code diffs before they are rendered into the interactive walkthrough sections of the HTML output.

explain-diff