The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes a local Python script scripts/validate_merge_plan.py which executes git commands via subprocess.run. These executions are used to retrieve repository metadata such as current HEAD, conflict status, and object hashes. The arguments for these commands are strictly defined within the script or derived from Git's own output, minimizing risks of command injection. No other shell execution or unsafe system calls were observed.
[EXTERNAL_DOWNLOADS]: The skill does not perform any network operations. There are no instances of curl, wget, or other downloaders, and the requirements.txt file is empty, indicating no external package dependencies are required.
[PROMPT_INJECTION]: The instructions in SKILL.md and references/analysis-rules.md focus purely on the technical task of Git conflict resolution. There are no attempts to override agent behavior, bypass safety filters, or extract system prompts.
[DATA_EXFILTRATION]: While the skill reads sensitive file content (source code) via git show to analyze conflicts, it contains no mechanism to transmit this data externally. All operations are confined to the local environment and the generation of a local report.
[CREDENTIALS_UNSAFE]: No hardcoded API keys, tokens, or credentials were found. The skill interacts with Git locally and does not require or store authentication secrets.

code-merge-helper