The Agent Skills Directory

[SAFE]: The skill performs diagnostic checks on local git settings to ensure commit signing is correctly configured. It does not attempt to disable security features or bypass mandatory signing requirements.
[COMMAND_EXECUTION]: Uses perl to execute ssh-keygen and gpg signing tests. The execution is wrapped in a 5-second alarm (alarm 5) to ensure the agent does not hang indefinitely if a key is locked and awaiting a manual passphrase entry.
[DATA_EXPOSURE]: The skill reads the public part of a signing key and may write it to a temporary file (/tmp/sigpre.pub) for the duration of a test signature. Public keys and git configuration keys (e.g., user.signingkey) are not sensitive credentials.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from the local git config. While this influences the agent's logic (deciding whether to ask the user to unlock a key), it relies on the local developer's own environment configuration and presents no significant attack surface.

signing-preflight