The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from git commit messages and file diffs which could potentially contain malicious instructions intended to influence the agent's behavior.
Ingestion points: Git commit history (git log) and file content changes (git diff) are read into the agent's context in SKILL.md.
Boundary markers: The skill uses Markdown code blocks for diffs and list items for commit messages, but lacks explicit instructions for the agent to ignore any commands embedded within the analyzed data.
Capability inventory: The skill utilizes bash to execute various git commands and reads file system data.
Sanitization: While the skill validates commit references, it does not sanitize the content of the messages or diffs being processed.
[COMMAND_EXECUTION]: The skill constructs and executes shell commands (git) using user-provided inputs such as time ranges, commit hashes, and file paths.
Evidence: User-supplied variables like <range>, <start>, and <end> are interpolated directly into shell command strings in SKILL.md (e.g., git log <range> --oneline).
Mitigation: The skill includes a validation step in SKILL.md to verify commit references and repository status before execution, reducing the risk of arbitrary command injection.

analyzing-git-sessions