The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection by incorporating untrusted external data into prompts sent to an LLM executor.\n
Ingestion points: The orchestrator in scripts/relay-sidecar.js reads PR diffs (via gh pr diff), project documentation (via walkDocCandidatePaths), and review artifacts (such as done-criteria.md and verdict.json).\n
Boundary markers: Prompt templates in scripts/kinds/context-recap.js, scripts/kinds/docs-sync.js, and scripts/kinds/test-gap.js use simple text headers (e.g., 'BASELINE RECAP:', 'DIFF EVIDENCE:') to delimit data but lack explicit instructions to the LLM to ignore potentially malicious instructions embedded within that data.\n
Capability inventory: The skill executes the opencode command with the generated prompts and writes the output to the repository file system at sidecars/<id>/output.md.\n
Sanitization: No sanitization, escaping, or filtering of the ingested content is performed before it is interpolated into the prompts.\n- [COMMAND_EXECUTION]: The script scripts/relay-sidecar.js executes system commands including gh pr diff to fetch pull request data and git status --porcelain to verify repository integrity. While these commands use arguments derived from the run manifest, the script implements a 'snapshot' check that fails the process if any file system mutations occur during the advisory run, mitigating risks of unauthorized persistence or modification.

relay-sidecar