The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes extensive shell command execution for Git management, file system operations, and development tool invocations (e.g., git status, git show, git rm, git add, mkdir, grep).
[REMOTE_CODE_EXECUTION]: The skill's workflow involves running package manager commands (npm install, cargo update, yarn install, bundle install, poetry lock) and test suites (npm test, cargo test, pytest) on files obtained from incoming Git branches. Because these files originate from potentially untrusted external sources, this pattern allows for the execution of malicious code embedded in the branch (e.g., through pre-install scripts in package.json or malicious test logic).
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests and analyzes the content of conflicted files from untrusted branches without sanitization or boundary markers.
Ingestion points: Conflicted file content is read via git show and diff analysis in SKILL.md and scripts/handle-deleted-modified.sh.
Boundary markers: The instructions do not define delimiters or provide 'ignore embedded instructions' warnings for the data being processed.
Capability inventory: The agent has the ability to execute shell commands, modify the file system, and commit changes to the repository.
Sanitization: No filtering or validation of the ingested file content is performed before it is presented to the model for logic analysis.
[DATA_EXFILTRATION]: The scripts/handle-deleted-modified.sh script creates persistent backups of conflicted file content in the .git/conflict-backups/ directory. While this is intended for recovery, storing unvalidated content from external branches in the .git directory could lead to unauthorized data exposure if that directory is inadvertently shared or accessed by other processes.

resolve-conflicts