The Agent Skills Directory

[COMMAND_EXECUTION]: Potential command injection in references/evidence-commands.md. The skill utilizes placeholders such as <story-id> and <N> within shell commands, specifically in git log -n <N>, rg -n "<story-id>|...", and git log --all --grep=<story-id>. If these variables are populated with unsanitized user input, an attacker could inject arbitrary shell commands.
[PROMPT_INJECTION]: Susceptibility to Indirect Prompt Injection through the ingestion of untrusted repository data. The skill is designed to read and analyze content from git log, git diff, AGENTS.md, and local documentation in docs/specs/ and specs/. If these files contain adversarial instructions, they could influence the agent's output or cause it to ignore its safety guidelines and traceability rules.
Ingestion points: Commands listed in references/evidence-commands.md that read git history, file diffs, and project documentation.
Boundary markers: Absent. There are no instructions requiring the agent to delimit external data or ignore instructions embedded within the processed text.
Capability inventory: The skill has the ability to execute git, find, rg (ripgrep), and sed via the system shell.
Sanitization: Absent. No evidence of input validation, escaping, or filtering exists to protect against malicious content in the repository data.

change-traceability-review