The Agent Skills Directory

[COMMAND_EXECUTION]: The SKILL.md file provides a shell command template for executing the extraction script: python3 <skill-dir>/scripts/extract_changes.py "<range>". If the agent naively substitutes a user-provided git range containing double quotes or other shell-sensitive characters into this template, it could lead to arbitrary command execution in the environment where the agent runs the command.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the repository being analyzed, including DAX code, measure descriptions, and documentation files (docs/metric-definitions/, docs/requirements/, docs/standards/). This content could be crafted to contain malicious instructions designed to manipulate the agent's analysis, bypass its safety guidelines, or influence the final review artifact.
Ingestion points: scripts/extract_changes.py reads visual.json and TMDL files from the git repository; SKILL.md instructs the agent to read various documentation files from the repo root.
Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present in the prompt templates.
Capability inventory: The skill possesses the capability to execute shell commands (Step 1 and Step 3) and write files to the scratchpad.
Sanitization: No evidence of sanitization or filtering of the ingested content is present in the skill instructions or scripts.
[DYNAMIC_EXECUTION]: The bundled Python scripts (scripts/extract_changes.py and scripts/check_artifact.py) use subprocess.run() to execute git commands. While they use the list-based API to prevent direct shell injection, they dynamically construct command arguments from user-supplied strings, which can still lead to argument injection if not strictly validated. Additionally, SKILL.md encourages the agent to use "python one-liners" to query the generated JSON model, which involves dynamic code generation and execution by the agent.

review-pbi-diff