The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the repository, including git diffs, commit messages, and specification files, which are then passed into sub-agent prompts for analysis.
Ingestion points: Content is retrieved via git diff, git log, and file reads from docs/, specs/, or .scratch/ (SKILL.md).
Boundary markers: The instructions do not define clear delimiters or include "ignore embedded instructions" warnings when passing external content to the sub-agents.
Capability inventory: The skill uses git commands (diff, log, rev-parse) and file system reads to gather information.
Sanitization: There is no evidence of sanitization or filtering of the ingested content before it is interpolated into the prompts for the Standards and Spec sub-agents.
[COMMAND_EXECUTION]: The skill uses user-supplied strings as arguments for shell-based commands like git diff <fixed-point>...HEAD and git rev-parse <fixed-point>. If the underlying agent execution environment does not properly sanitize these inputs, a malicious user could attempt command injection by providing a crafted git reference (e.g., using command separators). However, the skill explicitly instructs the agent to validate the reference using git rev-parse before proceeding, which serves as a mitigation step.

code-review