The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from git diffs, commit logs, and external issue trackers (Linear and GitHub), creating an attack surface for indirect prompt injection.
Ingestion points: External data enters context via git diff, git log, gh issue view, mcp__linear__get_issue, and reading local files such as .claude/plans/*/plan.md and spec files.
Boundary markers: The instructions provide some operational scope (e.g., "Focus on NEW code") but lack explicit delimiters or instructions for sub-agents to disregard potential malicious directives embedded in the ingested content.
Capability inventory: The skill has the ability to spawn multiple sub-agents (TaskCreate), write files to the project's .claude directory (Write), execute development tools (mix compile, mix test), and interact with the user (AskUserQuestion).
Sanitization: No evidence of explicit sanitization, validation, or escaping of the requirements text or diff data is present before interpolation into prompts for the specialized agents.
[COMMAND_EXECUTION]: The skill executes shell commands to perform code verification and repository operations.
Evidence: The skill uses git for diffing and logging, mkdir for directory setup, and a complex shell pipeline for Elixir verification: mix compile --warnings-as-errors && mix format --check-formatted $(git diff --name-only HEAD~5 | grep '\.exs\?$' | tr '\n' ' ') && mix credo --strict && mix test.
Note: The shell pipeline uses command substitution $(...) to process file lists from the repository, which is a common pattern in development skills but relies on the integrity of the local git environment.

review