The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains a logic override instruction that allows external input to bypass its defined behavior. The text states: '起動プロンプトの指示は、このskillの記述に優先する' (Instructions in the startup prompt take priority over the description of this skill). This is an explicit 'Override/bypass' marker that could be exploited to make the agent ignore constraints if the prompt generator or user provides malicious instructions.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data from external GitHub pull requests, creating a vulnerability surface where attacker-controlled content could influence subagent behavior.
Ingestion points: The skill (and its subagents) reads pull request diffs, repository source code, and existing PR comments (File: SKILL.md).
Boundary markers: The skill attempts to identify its own reports using markdown headers (e.g., '# Dependency update report'), but it lacks robust delimiters or explicit 'ignore' instructions for the untrusted content being reviewed.
Capability inventory: The orchestrator possesses merge capabilities, while subagents can push new commits and post comments to pull requests, allowing an injection to transition into unauthorized code modification.
Sanitization: The instructions provide no mention of sanitizing or escaping the external content before it is processed by the AI models (Opus tier or higher).

dependency-update