The Agent Skills Directory

[COMMAND_EXECUTION]: The skill frequently executes shell commands to manage the repository and build tools.
The agent uses git for branching, committing, and status checks, as well as npm run build to compile the local analyzer source.
A Node.js helper script, scripts/evidence-provenance.mjs, is used to perform high-integrity file operations and verify repository state using spawnSync for git operations.
[EXTERNAL_DOWNLOADS]: The skill configuration in mcp.json downloads external software from a public registry.
It uses npx to fetch and execute the gitnexus@1.6.12 package from the NPM registry at runtime.
These downloads are from a well-known service and are necessary for the skill's primary functionality.
[DYNAMIC_EXECUTION]: The skill implements a graph-freshness procedure that involves the dynamic generation and execution of code.
It compiles local source code (npm run build) and executes the resulting JavaScript artifact (node gitnexus/dist/cli/index.js analyze) to ensure the analysis graph matches the current code state.
[INDIRECT_PROMPT_INJECTION]: The skill processes engineering plans stored as markdown files, which represents a potential attack surface for indirect prompt injection.
Ingestion points: The skill reads plan documents from docs/plans/*.md using a security-hardened helper script.
Boundary markers: The instructions mandate strict adherence to specific plan sections (§11, §12) and require the use of the impact and detect_changes tools to verify all actions.
Capability inventory: The skill has permissions to write to the filesystem, modify git history, and execute build scripts and analysis tools.
Sanitization: The evidence-provenance.mjs script provides extensive protection against data tampering, using SHA-256 hashing and directory-descriptor anchoring to ensure the integrity of the data being processed.

gitnexus-work