The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingest data from the local repository (commit messages, workflow files, and configuration scripts) which could be manipulated by an attacker to include malicious instructions.
Ingestion points: File content and repository metadata are read using tools like cat, rg, git status, and gh repo view as specified in the Discovery Phase of SKILL.md.
Boundary markers: The skill does not implement delimiters or specific instructions to treat repository-sourced data as untrusted.
Capability inventory: The skill possesses significant capabilities via the Bash tool, including the ability to execute git, gh, find, rg, and cat commands.
Sanitization: No sanitization, escaping, or validation logic is defined for the data extracted from the repository before it is processed by the agent.

deployment-composer