The Agent Skills Directory

[SAFE]: The skill manages project metadata and guidelines using a Python script (scripts/harness.py) that incorporates multiple layers of defense. It uses pathlib.Path.resolve() and explicit containment checks to ensure file operations remain within authorized project directories, effectively preventing directory traversal attacks.
[SAFE]: The implementation performs strict validation against symbolic links for both project configuration files and knowledge directories. This mitigates risks associated with symlink-based attacks that attempt to trick the tool into accessing sensitive system files.
[COMMAND_EXECUTION]: The script interacts with the local git binary using subprocess.run. This is implemented securely using argument lists (avoiding shell interpolation) and environment scrubbing that removes GIT_ prefixed variables to prevent external manipulation of the git process identity or behavior.
[SAFE]: File writing operations are performed atomically using temporary files and filesystem synchronization (fsync), ensuring data integrity and durability while protecting against partial write vulnerabilities.

harness-recall