The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands to retrieve git metadata. In SKILL.md Step 2, the agent is directed to run git branch --show-current and interpolate the result into a subsequent shell call: SHA=$(git ls-remote origin "refs/heads/$BRANCH" | cut -f1). This creates a potential command injection surface if the local branch name contains shell metacharacters (e.g., backticks or command substitutions), which could lead to arbitrary command execution in the context of the agent's environment.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes data from external sources without isolation or sanitization. Ingestion points: The skill reads output from git ls-remote (remote references) and several Qualimetry MCP tools, including get_all_review_issues (issue explanations) and get_standards_compliant_example (source code). Boundary markers: Absent. The instructions do not prescribe using delimiters or system prompts to ignore instructions embedded within the fetched data. Capability inventory: The skill has the ability to execute shell commands and call additional tools. Sanitization: Absent. The skill does not describe any validation or escaping of the content returned by the MCP tools or git output before the agent processes it.

review-check