The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates agents reading and acting upon untrusted repository data, creating a surface for indirect prompt injection.
Ingestion points: Commit messages, branch names, and file diffs are ingested via but status, but diff, and but show (documented in references/inspection.md).
Boundary markers: The skill provides an AI-optimized output format (--format agent), though specific sanitization or delimiter behavior for this format is not detailed in the reference documentation.
Capability inventory: The agent is granted extensive capabilities including branch creation/deletion, commit editing (amend, squash, reword), pushing to remote forges, and modifying repository configuration (documented across references/branches.md, references/commits.md, and references/forge.md).
Sanitization: The documentation does not specify any sanitization, filtering, or validation steps for external content before it is processed by the agent.
[EXTERNAL_DOWNLOADS]: The skill documents commands that download and install software and configuration files from external sources.
Evidence: The commands but update install and but skill install fetch the GitButler desktop application and agent skill files from official GitButler domains (gitbutler.com), which are well-known services for this tool (documented in references/ai-agents.md and references/misc.md).
[CREDENTIALS_UNSAFE]: The skill documents the management of sensitive API keys and forge authentication tokens.
Evidence: Commands such as but config ai and but config forge auth are used to manage credentials for AI providers (Anthropic, OpenAI) and GitHub. The documentation correctly identifies best practices, such as using environment variables (--api-key-env) to avoid hardcoding secrets (documented in references/config.md).

but