The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted data from external sources and processes it with high-privilege tools.
Ingestion points: The skill reads commit messages, PR titles, and issue comments (specifically tunan:solution comments) via git log and gh CLI commands.
Boundary markers: There are no explicit instructions or delimiters (like XML tags or triple quotes) defined to help the agent distinguish between the skill's instructions and the content being summarized, nor are there warnings to ignore embedded commands.
Capability inventory: The skill utilizes Bash for command execution and Write for temporary file management, which could be exploited if an attacker embeds malicious instructions in a PR title or commit message.
Sanitization: The instructions do not specify any sanitization, filtering, or escaping of the gathered strings before they are interpolated into the report template.
[COMMAND_EXECUTION]: The skill dynamically generates shell commands using data derived from user-provided arguments.
Evidence: In the <lookback> section and Phase 1, the $ARGUMENTS provided by the user are resolved into date bounds which are then directly inserted into git --since and gh --search command strings.
Risk: If the agent fails to properly validate the 'lookback window' argument, a malicious user could attempt to inject additional shell commands into the execution flow.

retro