The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection because it processes untrusted data (git diffs and specifications) and passes them to sub-agents without safety boundaries.
Ingestion points: git diff output, git log output, specification files (e.g., from docs/, specs/, .scratch/), and repository standards files.
Boundary markers: Absent. The instructions do not define delimiters or warnings to ignore instructions embedded within the data.
Capability inventory: The skill spawns sub-agents and reads various local files.
Sanitization: None. Content is passed verbatim to the general-purpose sub-agent.
[COMMAND_EXECUTION]: The skill instructs the agent to construct shell commands using unsanitized user input.
The instructions state: "Whatever the user said is the fixed point — a commit SHA, branch name, tag, main, HEAD~5, etc. Don't be opinionated; pass it through." This input is then used directly in git diff <fixed-point>...HEAD and git log <fixed-point>..HEAD --oneline.
This pattern can lead to command injection if the underlying agent implementation executes these commands in a shell environment without validation.

review