The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/repo_report.py executes system commands using subprocess.run to interact with the local git binary and various PDF rendering engines (such as Chrome, WeasyPrint, or wkhtmltopdf). The implementation uses list-based arguments and, where appropriate, the -- separator to mitigate command injection risks from repository file paths or metadata.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from a local git repository's source files and commit history, which is then presented to the agent in the repo_report.json file for summarization.
Ingestion points: Source code is read in analyze_files and extract_excerpts; git history, subjects, and diffs are read in analyze_history and sample_prs within scripts/repo_report.py.
Boundary markers: Absent. While SKILL.md includes a workflow step for the user to review excerpts, there are no programmatic delimiters in the generated JSON or Markdown to prevent the agent from misinterpreting ingested repository data as instructions.
Capability inventory: The skill has the capability to read any file in the provided path, execute the local git binary, and write files to the output directory.
Sanitization: The script implements regex-based redaction for secrets (e.g., AWS keys, private keys) and PII (e.g., SSNs) in redact_secrets, but it does not sanitize text for potential instruction-based injection patterns.

repo-report