The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a user-provided "fixed point" (such as a commit SHA, branch name, or tag) and directly interpolates it into shell commands like git rev-parse <fixed-point>, git diff <fixed-point>...HEAD, and git log <fixed-point>..HEAD. This design is susceptible to command injection if a user provides a malicious string containing shell metacharacters (e.g., ;, &&, or backticks).
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the repository (git diffs, commit messages, and files in docs/ or specs/) and passes it into the prompts of parallel sub-agents. Maliciously crafted code or documentation could contain instructions designed to hijack the sub-agents' behavior.
Ingestion points: SKILL.md (Step 2 and 3) reads from docs/, specs/, .scratch/, CODING_STANDARDS.md, CONTRIBUTING.md, as well as git log and git diff outputs.
Boundary markers: The instructions do not implement delimiters or explicit warnings to the sub-agents to ignore instructions embedded within the source data.
Capability inventory: The main agent and sub-agents have the ability to execute git commands, read arbitrary files within the repository to verify findings, and spawn additional agent processes.
Sanitization: There is no evidence of sanitization, escaping, or validation of the content retrieved from the repository before it is interpolated into the prompts for the Standards and Spec sub-agents.

code-review