The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external, untrusted sources which serves as an attack surface for indirect prompt injection.
Ingestion points: The skill accepts input from repositories, branches, pull requests, release candidates, and deployed URLs as specified in the Contract section of SKILL.md.
Boundary markers: The instructions do not define specific delimiters or instructions to ignore embedded commands within the ingested data, such as code comments or PR descriptions.
Capability inventory: The skill can execute local git commands and delegates actions to deployment and PR management skills.
Sanitization: There is no mention of sanitizing or escaping the content retrieved from the external repositories before it is processed by the agent.
[COMMAND_EXECUTION]: The skill utilizes shell commands to gather evidence for the audit report.
Evidence: The Evidence Order section in SKILL.md defines the use of git status, git log, and git diff. These are restricted to informational, read-only operations on the local repository.

production-audit