The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it interpolates unvetted data from the repository into generated Markdown reports.
Ingestion points: The skill reads external data from git log (commit messages), git diff (code changes), quality_reports/plans/*.md, quality_reports/session_logs/*.md, and confidential-data.md (metadata/rules file).
Boundary markers: The Phase 2 template does not utilize delimiters or specific boundary markers to isolate interpolated content from the rest of the instructions.
Capability inventory: The skill possesses the Write tool (to create handoff files) and the Bash tool (used for information gathering).
Sanitization: The instructions do not mandate sanitization or filtering of the gathered content, meaning malicious instructions embedded in a commit message or a plan file could influence subsequent agents reading the brief.
[COMMAND_EXECUTION]: The skill uses the Bash tool to perform discovery and data collection within the repository.
Evidence: Subprocess calls include git log, git diff, git branch, and ls -t. These commands are standard for the skill's stated purpose of summarizing project changes and are limited to read-only discovery operations.

coauthor-brief