The Agent Skills Directory

Robust Data Handling: The skill includes explicit instructions for the agent to treat folder names as inert data. This is a security best practice designed to prevent 'indirect prompt injection' if a directory on the user's machine was maliciously named to look like an agent command.
CSV Injection Protection: The included Node.js script implements mitigations against spreadsheet formula injection (CSV Injection). It automatically escapes characters like '=', '+', and '-' in exported project names, ensuring that reports are safe to open in tools like Excel or Google Sheets.
Local Execution and Privacy: The transcript mining process is performed entirely on the local machine using standard system tools like git. No sensitive code or conversation content is sent to the AI model; only aggregate statistics and project names are used to generate the final summary.
Secure File Operations: The report generation script uses secure file writing flags (like refusing to follow symlinks in temporary directories) to prevent common local file system vulnerabilities during the HTML report creation process.
Human-in-the-Loop Safeguards: The skill is designed to surface all detected project names to the user before they are included in a shareable report, allowing for a privacy review to ensure no internal or sensitive codenames are accidentally disclosed.

receipts