The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructions explicitly command the agent to bypass standard safety guidelines and confirmation prompts. It states that the specific trigger word acts as pre-authorization, instructing the agent to proceed with destructive or high-risk actions (like pushing to a main branch) without asking for user confirmation.
[COMMAND_EXECUTION]: The skill automates a chain of shell and git commands, including git add -A, git commit, git merge, and git push, which are executed without human-in-the-loop validation of the command parameters.
[CREDENTIALS_UNSAFE]: The skill references and accesses sensitive file paths such as .env, *.pem, *.key, id_rsa, and *credentials*.json. While this is part of a security check to prevent accidental commits, it involves the agent searching for and identifying local credential files.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted data that could influence the agent's behavior during command generation.
Ingestion points: The agent reads output from git status --porcelain -uall and git diff --cached --stat from the local repository (SKILL.md).
Boundary markers: None are present to separate the untrusted repository data from the agent's internal instructions.
Capability inventory: The agent has the capability to stage all files (git add -A), generate commit messages based on diffs, and push changes to remote servers (git push).
Sanitization: There is no sanitization of the file content or diff output before it is used to generate the commit message or determine the branch name.

grond