The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using user-supplied input without sanitization. Specifically, the 'fixed-point' provided by the user is directly interpolated into commands like git diff <fixed-point>...HEAD, git log <fixed-point>..HEAD --oneline, and git rev-parse <fixed-point>. A malicious user could provide input containing shell metacharacters (e.g., ;, &&, or backticks) to execute unauthorized commands.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the repository and includes it in prompts for sub-agents without sanitization or boundary markers.
Ingestion points: Data is ingested from commit messages (via git log), spec files in docs/, specs/, or .scratch/, project documentation such as CODING_STANDARDS.md and CONTRIBUTING.md, and output from an external issue tracker.
Boundary markers: The instructions lack markers or delimiters (like XML tags) to prevent the sub-agents from following instructions embedded within the diffs or spec files.
Capability inventory: The skill utilizes git for diffing and logging, reads file contents, and spawns parallel sub-agents to process this data.
Sanitization: No sanitization or filtering of the ingested content is performed before it is passed to the sub-agents.

code-review