The Agent Skills Directory

[PROMPT_INJECTION]: The skill summarizes untrusted data from sources such as git diffs and PR patches, which exposes the agent to indirect prompt injection.
Ingestion points: Untrusted content enters the context through the output of git commands and user-provided patch text in SKILL.md.
Boundary markers: There are no explicit instructions for using delimiters to isolate untrusted content from the prompt instructions.
Capability inventory: The skill has read-only access to repository files and git history but lacks network access or the ability to modify files.
Sanitization: There is no logic provided to sanitize or filter external content before it is summarized by the agent.
[COMMAND_EXECUTION]: The agent is instructed to use shell commands including git status --short and git diff to identify and inspect changes in the target repository. These commands are restricted to local repository inspection.

change-explainer