The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes several shell commands, including git log, git show, git diff, and git rm. These commands include a variable <feature> which is derived from user input. This creates a surface for command injection if the user provides a maliciously crafted feature name containing shell metacharacters.
[INDIRECT_PROMPT_INJECTION]: The skill reads and interprets historical data from the git repository, which represents an untrusted ingestion surface.
Ingestion points: Git commit history, commit messages, .walden/specs/ document content, and .walden/evidence/ JSON files (SKILL.md).
Boundary markers: The skill requires the agent to explicitly label claims as [sealed] or [inferred], which provides a distinction between recorded data and interpreted narration.
Capability inventory: Access to the git CLI for repository inspection and file deletion (git rm), and sed for parsing document frontmatter.
Sanitization: No explicit sanitization, validation, or escaping of the historical content is mentioned before the agent processes and narrates it.

walden-history