The Agent Skills Directory

[Indirect Prompt Injection] (HIGH): The skill is susceptible to instructions embedded in the data it processes.
Ingestion points: Untrusted data enters the agent context via git status, git diff HEAD, git branch --show-current, and git log --oneline -10 as defined in the Context section of SKILL.md.
Boundary markers: Absent. The output of these commands is interpolated directly into the prompt without delimiters or warnings to ignore embedded instructions.
Capability inventory: The skill has access to git add and git commit tools as defined in the frontmatter.
Sanitization: None. There is no logic to filter or escape instructions found within the repository's files or history.
Risk: An attacker contributing to the repository could include malicious prompts in a file (detected by git diff) or in a previous commit message (detected by git log) to trick the agent into staging sensitive files or creating deceptive commits.
[Command Execution] (LOW): The skill uses shell commands via the ! syntax to gather context. While restricted to git-related queries, this relies on executing subprocesses based on instructions in the markdown file.

commit