The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from multiple sources and interpolates it into prompts for sub-agents, creating a surface for indirect prompt injection.
Ingestion points: Data is gathered from git diff output, git log commit messages, and external specification sources fetched via the workflow described in docs/agents/issue-tracker.md or from files in .scratch/.
Boundary markers: The process in Step 4 for spawning sub-agents lacks explicit instructions to use delimiters or "ignore embedded instructions" warnings when including the untrusted diff and spec content.
Capability inventory: The skill uses git tools to read repository state and spawns sub-agents to perform qualitative analysis of that state.
Sanitization: There is no documentation of sanitization or escaping of the gathered external content before it is processed by the AI sub-agents.
[COMMAND_EXECUTION]: The skill executes shell commands (git diff, git log, git rev-parse) using a user-supplied <fixed-point> argument. This is a necessary component of the skill's primary function but represents a standard command injection surface if the underlying execution platform does not properly sanitize the input reference.

code-review