The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from git diffs, commit messages, and external specification files to generate prompts for its sub-agents. An attacker could potentially include malicious instructions within a code diff or a spec file to influence the agent's behavior or output.
Ingestion points: File SKILL.md (Git diff output, commit logs, and files retrieved from docs/, specs/, or .scratch/ directories).
Boundary markers: The instructions for prompting the sub-agents lack explicit delimiters or markers to separate untrusted content from the agent's instructions, increasing the risk of the agent obeying embedded commands.
Capability inventory: The skill uses git diff, git log, and git rev-parse, along with general file reading capabilities.
Sanitization: No explicit sanitization or filtering is performed on the ingested content before it is used to construct prompts for the sub-agents.
[COMMAND_EXECUTION]: The skill uses shell-based git commands to resolve references and retrieve diffs. While it attempts to validate references using git rev-parse, the security of these operations depends on the platform's ability to prevent command injection from user-supplied branch or commit names.

code-review