The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the agent to interpolate user-provided arguments into a shell command: git log --oneline [last-tag]..HEAD. This pattern is vulnerable to command injection if a user provides a crafted version string containing shell metacharacters.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8) because it processes untrusted data from the repository environment. Ingestion points: Git commit history (via git log), sprint reports in production/sprints/, and design documents in design/gdd/. Boundary markers: The skill lacks delimiters or explicit instructions to isolate the external content from the agent's logic. Capability inventory: The combination of Read, Glob, Grep, and Bash tools provides a significant attack surface if the agent follows malicious instructions embedded in the logs or documentation. Sanitization: No content validation or sanitization is performed on the ingested data before processing.

changelog