The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes several shell commands, including git status, git log, git diff, node scripts/render-html.mjs, and pnpm deploy:preview. The use of the ref argument in git diff <ref> introduces a surface for argument injection if the underlying agent platform does not sanitize user input before shell execution.
[INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from the repository, such as commit messages and code diffs, to generate summaries and architectural diagrams. Malicious content within the repository could attempt to influence the agent's analysis.
Ingestion points: Untrusted data enters the context via git log (commit messages) and git diff (file contents and changes).
Boundary markers: The instructions include "Hard rules" to treat repo content as untrusted, though no specific technical delimiters for the prompt interpolation are defined in the markdown.
Capability inventory: The skill can write files (apps/recap-web/src/content/session.json), execute local scripts (node scripts/render-html.mjs), and trigger external deployments (pnpm deploy:preview).
Sanitization: The workflow includes a "Validation board" and a "privacy pass" intended to flag private paths and prevent sensitive data leaks before the final HTML is rendered.

recap-session