The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted code from local branches which is then provided to AI sub-agents, creating an attack surface where instructions embedded in code could influence agent behavior.
Ingestion points: Local diffs are captured to /tmp/branch-$SLUG.diff and passed to sub-agents in SKILL.md.
Boundary markers: The skill uses a charter to define scope but lacks robust structural markers to prevent instruction injection from the code content.
Capability inventory: Sub-agents have access to tools that can execute bash commands and perform file operations within the sandbox.
Sanitization: The skill documentation mentions a 'single-verdict shell gate' designed to prevent host RCE by verifying proof-of-work before processing content.
[COMMAND_EXECUTION]: The skill logic uses shell scripts to process diff content, which is a known risk pattern for command injection.
Evidence: The skill documentation in Step 5 explicitly mentions that its verification logic was designed to stop host RCE after experiencing multiple real-world incidents, specifically highlighting the risk of using sed on untrusted diff content.

review-local-branch