The Agent Skills Directory

[COMMAND_EXECUTION]: The skill performs multiple shell operations including git branch detection, SHA parsing, and force-pushing. It also executes a local script located at .claude/skills/rebase-downstream/detect-chain.sh. While these are part of the core functionality, they represent a significant capability to modify the local environment and remote repositories.- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data in the form of the starting-branch argument and branch names retrieved from the system. It interpolates these variables directly into shell commands (e.g., bash detect-chain.sh <starting-branch> and git rev-parse <branch>). This creates a vulnerability surface for command injection if a branch name contains shell metacharacters (e.g., branch-name; rm -rf /).
Ingestion points: starting-branch argument in SKILL.md; output of git branch and the detect-chain.sh script.
Boundary markers: None present in the prompt templates.
Capability inventory: Shell execution of git commands and bash scripts.
Sanitization: No instructions for escaping or validating branch names before shell interpolation.- [DYNAMIC_CONTEXT_INJECTION]: The skill utilizes the !command`` syntax to execute git branch --show-current and git status --short at load time. These specific commands are benign and used to provide context to the agent, but they demonstrate the use of pre-execution hooks.

force-push-downstream