The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions provide a shell variable assignment pattern REPO="${ARGUMENTS:-$(pwd)}" and subsequently interpolate this variable into several shell commands such as cat and git. If the environment passing $ARGUMENTS does not perform strict sanitization, an attacker could provide a malicious path containing shell metacharacters (e.g., semicolons, pipes, or backticks) to execute arbitrary commands. Evidence: The pattern REPO="${ARGUMENTS:-$(pwd)}" followed by cat "$REPO/COMMIT_AGENTMSG" and git -C "$REPO" ... in SKILL.md relies on the integrity of user-supplied arguments.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external content from commit messages and git logs without using delimiters or sanitization. This creates an attack surface where malicious instructions embedded in a commit message could influence the agent's evaluation or logic.\n
Ingestion points: The skill reads content from COMMIT_AGENTMSG, git diff output, and git log output (SKILL.md).\n
Boundary markers: Absent. There are no explicit markers or instructions to treat the ingested content as data rather than instructions.\n
Capability inventory: The agent has access to shell commands (git, cat) which are used to gather inputs and could be manipulated by injected instructions.\n
Sanitization: Absent. No sanitization or escaping is performed on the ingested text before it is processed by the agent.

review-commit-message