The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions guide the agent to construct and execute shell commands by interpolating variables such as <remote>, <branch>, and <paths> directly into bash strings.
Evidence: In Phase 3 (Build Push Plan), the instructions define commands like git checkout -b tmp-push-<remote>-$$ <branch> and git rm -rf --cached <paths>.
Risk: The use of shell variables in this manner is susceptible to command injection if the input strings (remote names or paths) contain shell metacharacters like semicolons, pipes, or backticks.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted user data from CLI flags which are then used to influence subsequent shell operations.
Ingestion points: The --remotes and --exclude flags in SKILL.md accept arbitrary string input from the user.
Boundary markers: The skill does not define any delimiters or instructions for the agent to treat these inputs as literal data or to ignore embedded control characters.
Capability inventory: The skill has extensive access to the host environment via bash for git operations, including branch management, index modification, and network communication via git push.
Sanitization: There is no mention of input validation, escaping, or sanitization before the data is interpolated into shell commands.
[DYNAMIC_EXECUTION]: The skill utilizes a dynamic execution pattern by assembling a sequence of git operations at runtime to handle content filtering.
Evidence: The 'Filtered Push' strategy involves a multi-step sequence of script-like actions (stashing, branching, removing files from cache, and force pushing) that are generated based on user-provided parameters.
Risk: Generating and executing sequences of commands from runtime variables is a high-risk pattern that requires robust validation to prevent execution of malicious code.

sc-push