The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted external data such as git diffs, file contents, and third-party feedback by passing it to a secondary agent (Claude CLI). This creates a vulnerability where malicious instructions embedded in that data could influence the agent's analysis or output.
Ingestion points: Untrusted content is ingested via the <prompt> shell argument and piped context files (.turbo/claude/<tag>-ctx.txt) described in SKILL.md (Step 2).
Boundary markers: The instructions do not specify the use of clear delimiters or markers to isolate untrusted content from the primary instructions provided to the Claude CLI.
Capability inventory: The CLI is invoked with tools including Read, Grep, and specific Bash git subcommands (git diff, log, show, status, etc.).
Sanitization: The skill provides a manual warning for the developer to avoid shell-active characters like backticks and dollar signs, but does not implement automated sanitization or escaping of the ingested data.
[COMMAND_EXECUTION]: The skill executes the claude CLI through shell commands. While it emphasizes the use of read-only permissions and restricted git subcommands, it explicitly acknowledges the risk of shell interpolation (e.g., using backticks or $) within the prompt argument, which could lead to unintended command execution if the input text is not strictly controlled.

claude-print