The Agent Skills Directory

Command Execution: The skill executes local git utilities (git diff, git log, git merge-base) to gather information about the branch being checked. It also invokes a setup preflight script using a local Python module (setup_preflight). These commands are scoped to the skill's analytical functions and intended local environment.
Indirect Prompt Injection Surface: The skill processes external content, specifically code diffs and commit messages, which are untrusted data sources. This constitutes an indirect prompt injection surface. The skill proactively addresses this by including a dedicated check (Category E) to detect malicious instructions and by providing explicit instructions to treat all analyzed content as data, not directives.
Credential Scanning Feature: Within its contribution checks (Category D), the skill specifically looks for accidentally committed credentials, such as .env files or token-like strings. This is a defensive security measure designed to prevent data exposure in the resulting pull request.
Local Configuration Access: The skill references configuration paths like .apache-magpie-local and .apache-magpie-overrides. These are used for project-specific settings and overrides, following the established conventions of the framework author.

pre-first-pr-check