The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from local source code and git diffs to perform refactoring tasks, creating an attack surface for indirect prompt injection.
Ingestion points: The agent reads git diff output and the content of modified and adjacent source files in the local repository (SKILL.md, Step 2).
Boundary markers: The instructions do not define explicit delimiters or instructions to ignore potential commands embedded within the code being analyzed.
Capability inventory: The agent has the capability to read/write files, execute git commands, and run shell-based test suites (SKILL.md, Step 4).
Sanitization: There is no evidence of sanitization or filtering of the file content before it is processed by the agent's classification logic.
[COMMAND_EXECUTION]: The skill instructs the agent to execute arbitrary shell commands to verify changes via test suites.
Evidence: Step 4 of SKILL.md requires the agent to "run the narrowest covering test for its file, symbol, or package" whenever executable code is modified. This grants the agent the ability to execute environment-specific testing tools.

deslop