The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes Node.js scripts for managing development journals and rendering reports. These scripts use robust argument parsing and input validation to ensure safe operation when invoked by an agent.
[INDIRECT_PROMPT_INJECTION]: While the skill processes external data (JSON/JSONL), it implements rigorous sanitization. This includes escaping HTML entities, using a secure JSON embedding strategy (safeJSON), and enforcing a strict protocol allow-list (restricting to http, https, and mailto) for all links to prevent script injection.
[PRIVILEGE_ESCALATION]: The tool features sophisticated 'path guards' that verify output destinations are regular files and do not alias (via symlinks or hard links) any input sources. This prevents the tool from being used to overwrite sensitive system or project files.
[DATA_EXPOSURE]: It includes a dedicated utility to sanitize CI-related URLs, ensuring that any embedded authentication tokens, passwords, or sensitive query parameters are removed before the URLs are recorded in the final reports.
[SAFE]: The implementation relies exclusively on built-in Node.js modules, avoids all network activity, and demonstrates a high degree of security awareness through its extensive test suite and defensive coding patterns.

development-timeline