The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/scrub_repo.py utilizes the subprocess module to interact with the local system's Git binary to inspect repository state and history. Findings include:
The git() helper function passes arguments as a structured list to subprocess.run(), which is a security best practice that prevents shell injection attacks.
The commands executed are hardcoded within the script (e.g., ls-files, log, rm, shortlog) and are used solely for scanning and managing the local repository as described.
[INDIRECT_PROMPT_INJECTION]: As the skill is designed to process external repository content, it possesses an inherent surface for indirect prompt injection where malicious text in a scanned repo could target the agent processing the output.
Ingestion points: File content is read using Path.read_text() in the scan() function of scripts/scrub_repo.py.
Boundary markers: The script does not wrap scanned content in explicit delimiters or 'ignore' instructions when presenting results to the agent.
Capability inventory: The skill has the capability to write to local files (LICENSE, .gitignore, .env.example) and execute Git subcommands.
Sanitization: The script mitigates data exposure by redacting detected secrets in its output, though it does not otherwise sanitize or escape arbitrary text found in scanned files.

repo-scrub