The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted git metadata which serves as an indirect prompt injection surface.
Ingestion points: Git metadata is read via git branch, git status, and git remote as described in SKILL.md.
Boundary markers: The skill lacks delimiters or explicit instructions to ignore embedded instructions when interpolating these values into shell templates.
Capability inventory: The skill utilizes bash to execute sensitive git operations including branch creation, deletion, and force-pushing.
Sanitization: No evidence of input validation or shell escaping for branch names, remote names, or file paths is present in the workflow.
[COMMAND_EXECUTION]: The skill dynamically generates and executes bash commands for complex git workflows.
Evidence: SKILL.md defines command templates such as git push <remote> tmp-push-<remote>-$$:<branch> --force that are populated at runtime with variables derived from the local environment.

sc-push