The Agent Skills Directory

[COMMAND_EXECUTION]: The skill directs the agent to interpolate a user-supplied 'marker word' into a shell-based git grep command. This design is highly vulnerable to command injection; a malicious user providing shell metacharacters (e.g., semicolons, backticks, or pipes) in the marker word could trigger the execution of arbitrary commands on the host system.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill ingests untrusted data by reading codebase comments through git grep output as specified in SKILL.md.
Boundary markers: The instructions lack any requirement for boundary markers or warnings to the agent to disregard instructions potentially embedded within the code comments.
Capability inventory: The skill utilizes git grep for scanning and includes a capability to write results to a local file (PONYTAIL-DEBT.md).
Sanitization: There is no evidence of sanitization or escaping of the comment content before it is processed by the agent or written to the report.
[PROMPT_INJECTION]: The skill's instructions include phrases like "normal mode to revert," which are frequently used in prompt injection and jailbreak attempts to manipulate an agent into bypassing its standard operational constraints or resetting its context.

ponytail-debt