The Agent Skills Directory

[REMOTE_CODE_EXECUTION] (MEDIUM): Use of git bisect run allows for automatic execution of arbitrary commands or scripts present in a repository.
Evidence: The skill provides examples such as git bisect run ./test.sh and git bisect run npm test in the 'Automated Bisect' and 'Workflow 3' sections of SKILL.md.
Risk: An attacker-controlled repository could include a malicious test.sh or a backdoored package.json (triggering via npm test) that executes code when the agent attempts to troubleshoot or find a bug.
[COMMAND_EXECUTION] (LOW): The skill relies heavily on executing a variety of Git commands that modify the filesystem and interact with remote servers.
Evidence: Frequent use of git rebase, git push --force-with-lease, and git worktree throughout the document.
Risk: While standard for Git, these commands provide a broad capability surface for an agent that might be manipulated into destructive actions if boundary markers for repository content are not strictly enforced.
[INDIRECT_PROMPT_INJECTION] (MEDIUM): The skill is designed to process external, potentially untrusted repository data through code execution paths.
Ingestion points: Git repository history and files accessed during bisect or rebase operations.
Boundary markers: None specified in the instructions to separate agent logic from untrusted repository scripts.
Capability inventory: subprocess execution via git bisect run, and file modification via git rebase/reset.
Sanitization: No validation of the safety of the test.sh or npm scripts before execution.

git-advanced-workflows