The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes the claude CLI tool using shell commands. It includes mitigation strategies by explicitly defining a restricted list of allowed tools (read-only git subcommands) via the --allowedTools flag to prevent unauthorized modifications to the codebase.
[PROMPT_INJECTION]: The skill is designed to ingest and process third-party data, such as code diffs and external feedback, creating a surface for indirect prompt injection.
Ingestion points: External data enters the agent context via the <prompt> argument and files stored in the .turbo/claude/ directory which are then piped to the CLI's stdin.
Boundary markers: The instructions recommend piping context files to avoid shell interpolation, but they do not provide specific text delimiters or instructions for the sub-agent to distinguish between system prompts and external data.
Capability inventory: The skill uses the claude CLI which, although restricted by default, has the capability to read files and execute shell-based git commands.
Sanitization: Documentation explicitly warns the user to avoid using backticks or shell variables ($) within command arguments to prevent command injection at the shell level.

claude-print