The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests git commit messages (subject and body) which are untrusted data. These messages could contain hidden instructions designed to trick the agent during the report generation process.\n
Ingestion points: The run_git_log function in scripts/git_weekly_report.py extracts commit metadata directly from the local repository history.\n
Boundary markers: The skill instructions do not utilize delimiters or provide explicit warnings for the agent to ignore instructions embedded within the commit text.\n
Capability inventory: The skill allows the agent to execute shell commands (via the provided script), read from the filesystem, and write output to files.\n
Sanitization: The script truncates commit bodies to 500 characters but performs no content escaping or validation to prevent injection attacks.\n- [COMMAND_EXECUTION]: The script scripts/git_weekly_report.py executes the git binary using subprocess.run. It passes several parameters, including repository paths and date filters, which are derived from user input. While the use of an argument list (instead of a shell string) prevents basic shell injection, the tool still provides a mechanism for the agent to interact with the local filesystem via git.\n- [DATA_EXFILTRATION]: The skill's primary function is to read and summarize commit history. If the agent is directed to access sensitive or private repositories, this information is brought into the agent's context. Malicious commit content could attempt to leverage this access to exfiltrate data.\n- [PERSISTENCE]: The --output argument in the Python script facilitates writing the generated JSON report to a file. The SKILL.md instructions allow the agent to save the report to a path specified by the user. Without proper path validation or sandboxing, this could be exploited to overwrite critical system or configuration files, such as shell profiles (~/.bashrc), to establish persistence or disrupt the system.

git-weekly-report