The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted data from external sources.
Ingestion points: The skill reads data from git diff outputs, commit messages (git log), and external specification files located in docs/, specs/, or .scratch/ directories (SKILL.md, Steps 1 and 2).
Boundary markers: The instructions do not define clear delimiters or "ignore embedded instructions" warnings for the sub-agents when they are processing the diff and spec contents.
Capability inventory: The sub-agents have access to the platform's tools, including shell and file system access. Although Step 5 of SKILL.md provides a read-only instruction, this is a soft constraint that could be targeted by injection content.
Sanitization: The skill does not perform any validation, filtering, or escaping of the ingested code diffs or specification content before passing them to the sub-agent prompts.

code-review