The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by processing repository data that could be controlled by an external actor.
Ingestion points: Repository state, commit messages, and file contents are read via commands like jj status, jj log, and by processing conflict markers as described in references/recovery-playbook.md.
Boundary markers: The skill mitigates accidental execution by instructing the agent to use specific non-interactive flags (e.g., --no-pager, -m) and providing the verify_handoff.sh script for final state validation.
Capability inventory: The agent is granted significant capabilities, including shell execution of jj, git, gh, and glab commands across multiple scripts.
Sanitization: No explicit sanitization, validation, or escaping of repository-derived data is defined before its interpolation into command arguments.
[COMMAND_EXECUTION]: The skill is designed to execute a wide variety of version control and developer CLI commands. It includes helper scripts detect_jj_state.sh and verify_handoff.sh that wrap these executions to provide structured feedback to the agent.

jujutsu-workflow