The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts commit_planner.py, message_linter.py, and secret_gate.py utilize the Python subprocess module to interact with the local Git binary. The scripts use secure invocation patterns with list-based arguments and shell=False, which effectively prevents command injection from untrusted diff content or filenames.
[SAFE]: The skill implements a robust 'secret gate' that identifies provider-shaped tokens (AWS, GitHub, Slack, etc.) and high-entropy literals assigned to sensitive keys. The detection logic includes redaction for reported matches and uses SHA256 hashing for its waiver system, ensuring that the tool itself does not leak or store sensitive values in plain text.
[PERSISTENCE]: The skill includes Git hooks (pre-commit, commit-msg, pre-push) in the assets/hooks/ directory. These are standard Git features that execute local validation logic during the commit and push process. Their use is transparent, documented, and requires manual installation by the user.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from git diff and commit history. It mitigates potential injection by producing structured JSON output and applying redaction and entropy-based filtering to the processed data, preventing external content from influencing the agent's control flow.

commit-craft