The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements a manual affected detection strategy in scripts/get-affected.ts that reads the name property from package.json files within the repository. These extracted names are then passed to a GitHub Actions matrix strategy and interpolated directly into a shell command (pnpm --filter ${{ matrix.package }} test). If an attacker modifies a package.json file to include shell metacharacters in the name field, it could result in arbitrary command execution on the CI runner when the workflow triggers.
Ingestion points: The getPackages() function in scripts/get-affected.ts reads and parses package.json files from the packages/ directory.
Boundary markers: No boundary markers or delimiters are used to wrap the package names when they are passed to the matrix or the shell command.
Capability inventory: The test-affected job executes shell commands via the run key, providing a platform for command execution.
Sanitization: There is no validation or sanitization of the package.json name field before it is used to filter commands in the shell environment.
[COMMAND_EXECUTION]: The custom script scripts/get-affected.ts uses the child_process.execSync module to execute Git commands (git diff). While the target branch defaults to a static value, this pattern involves executing system-level commands based on data derived from the repository environment.

monorepo-ci-optimizer