The Agent Skills Directory

[COMMAND_EXECUTION]: The skill takes raw user input via the $ARGUMENTS variable and incorporates it directly into shell commands, specifically git diff <base>...HEAD. There is no evidence of sanitization, escaping, or validation of this input. If the underlying tool execution environment does not handle shell escaping, a user or a malicious script providing a branch name like main; [malicious_command] could trigger arbitrary command execution within the agent's environment.
[INDIRECT_PROMPT_INJECTION]: The skill's primary purpose is to ingest and analyze untrusted content (code diffs and files).
Ingestion points: Content is pulled into the agent's context through git diff and the Read tool as specified in SKILL.md instructions.
Boundary markers: The skill lacks explicit boundary markers or instructions for the agent to ignore potential commands embedded within code comments or string literals in the scanned files.
Capability inventory: The skill has access to local inspection tools including git, ls, find, grep, and Read, but lacks network or file-write capabilities based on allowed-tools.
Sanitization: No sanitization or filtering is performed on the ingested code before it is processed by the model.

first-five