The Agent Skills Directory

[COMMAND_EXECUTION]: The test suite in scripts/tests/test_guardrails.py uses subprocess.run to execute the local Python detector. This is used strictly for internal validation and does not involve executing untrusted or remote commands.
[DYNAMIC_EXECUTION]: The scripts/tests/test_guardrails.py file uses importlib to load scripts/block-dangerous-git.py as a module. This is a standard Python practice for testing scripts and is limited to local file system access.
[INDIRECT_PROMPT_INJECTION]: The skill handles command strings that could be influenced by untrusted data as part of its core functionality to block dangerous operations. Ingestion points: The detector script scripts/block-dangerous-git.py processes command strings provided via sys.stdin in the tool_input.command field. Boundary markers: The script employs shlex for shell-aware parsing and handles line continuations and handles comments to prevent bypasses. Capability inventory: The detector itself only outputs JSON and does not possess capabilities for file writing or network access. Sanitization: The script includes specific logic to avoid echoing command arguments in its denial messages, preventing the exfiltration of potentially sensitive data contained within the blocked command.
[PERSISTENCE]: The skill instructs the agent to modify hook configuration files (.claude/settings.json, .codex/hooks.json) to install the guardrail. This modification is persistent but is the intended and documented function of the skill.

git-guardrails