The Agent Skills Directory

[SAFE]: No malicious patterns or security vulnerabilities were identified in the skill's code or instructions. The behavior of the scripts aligns perfectly with the skill's stated purpose of repository history investigation.
[COMMAND_EXECUTION]: The skill uses Python's subprocess module to execute git and gh commands. The implementation uses list-style arguments (e.g., subprocess.run(['git', 'blame', ...])), which is a secure pattern that effectively prevents shell injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: The history_context.py and compact_pr.py scripts fetch pull request metadata and discussion history from GitHub. These network operations are conducted through the official GitHub CLI (gh), communicating with a well-known and trusted service (GitHub) to gather context for the user.
[DATA_EXFILTRATION]: All data processed by the skill is either retrieved from the local file system (git history) or the user's authenticated GitHub environment. There is no evidence of sensitive data being sent to unauthorized or unknown external domains.

investigating-repository-history