The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local shell scripts (gather-gh-events.sh, find-sessions.sh, gather-gh-search.sh, gather-atlassian.sh) to collect data from the user's environment.
Evidence: These scripts use standard tools like gh, jq, and curl to interact with authorized GitHub and Atlassian APIs.
[EXTERNAL_DOWNLOADS]: The skill fetches activity data from GitHub (via gh api) and Atlassian (via curl).
Evidence: Targeted domains include api.github.com and api.atlassian.com. These are recognized as trusted/well-known services for the purpose of engineering work recaps.
[SAFE]: The skill implements strong defensive measures for the data it processes.
Evidence: The instructions in SKILL.md explicitly mandate HTML-escaping for all untrusted data (PR titles, comments, session logs) to prevent XSS.
Evidence: The assets/template.html includes a strict Content Security Policy (CSP) that blocks external scripts and network requests (except for brand fonts), providing a second layer of defense against malicious content in processed data.
Evidence: The skill specifically warns the agent to treat external content (GitHub comments, session logs) as untrusted data rather than instructions to follow, mitigating indirect prompt injection risks.
Evidence: Credentials (API tokens) are managed using temporary netrc files with restricted permissions (umask 077) rather than passing them as command-line arguments, preventing exposure in process lists.

daily-recap