The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the repository's environment that can influence filesystem operations.
Ingestion points: The URL variable in Phase 4 of the link command, which is populated by git remote get-url origin.
Boundary markers: None present. The URL data is interpolated directly into shell scripts for path construction.
Capability inventory: The skill uses mkdir -p, rsync, mv, and ln -s across various phases (specifically Phase 4 and 5) to manipulate the derived vault paths.
Sanitization: The sed filter logic in SKILL.md (Phase 4) strips protocols and credentials but fails to sanitize for path traversal sequences like .., allowing a maliciously crafted remote URL to point outside the intended vault directory.
[COMMAND_EXECUTION]: Shell logic in the link command uses an unsanitized SLUG variable derived from external git configuration to execute filesystem commands. An attacker who can influence the repository's remote URL could use traversal sequences (e.g., github.com/../../tmp/) to cause the rsync or mv operations to write repository content to arbitrary locations accessible to the agent.

psi