The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill implements a verification loop that executes shell commands for every commit in the new history. As described in REBUILD.md, the instruction (cd "$VERIFY_TREE" && <checks planned for this commit>) runs commands generated by the agent during the planning phase. If the agent's plan is influenced by malicious input, this mechanism could be used to execute arbitrary commands within the local development environment.
[INDIRECT_PROMPT_INJECTION]: The skill's workflow depends on reading and interpreting untrusted data from the local repository, specifically through git log and git diff. This data is used in Step 1 of SKILL.md to design the new commit sequence and identify the validation checks. A malicious repository could contain content in files or commit history designed to trick the agent into performing unintended actions or skipping safety checks.
Ingestion points: The agent reads the complete diff of MERGE_BASE..ORIG and the existing commit log to design its plan.
Boundary markers: The instructions do not define specific delimiters to isolate repository content from the agent's internal reasoning or instructions.
Capability inventory: The skill uses git reset, git commit, git worktree, and arbitrary shell command execution in the validation step.
Sanitization: There is no explicit sanitization of the content extracted from git diffs or logs before it is used to interpolate shell commands.

recommit