The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill audits external repository manifests and Git metadata, which are untrusted data sources. The documentation explicitly notes that policy and workflow strings are not sanitized for hidden instructions, representing an indirect injection surface.
Ingestion points: Data enters the agent context through manifest.json files and local/remote Git repository metadata during scanning and discovery operations.
Boundary markers: The tool relies on structured JSON outputs and explicit command-line flags (--manifest) to scope its operations.
Capability inventory: The tool executes subprocesses for git, gh, and the custom workspacectl binary.
Sanitization: The skill provides a detailed policy for suppressing Git-based execution vectors, such as disabling system-level config, hooks, and clean/process filters, which mitigates the risk of the agent executing arbitrary code hidden in repository configurations.
[COMMAND_EXECUTION]: The skill requires the execution of git, gh, and the workspacectl command-line utility. These commands are integral to the skill's primary purpose of repository auditing. The tool implements safety measures (e.g., removing GIT_* environment variables and binding GIT_WORK_TREE) to ensure commands are executed within a restricted context.
[EXTERNAL_DOWNLOADS]: The skill instructions direct the agent to install a locally built Node.js package. The use of safety flags such as --ignore-scripts during the installation process ensures that potentially malicious lifecycle scripts in the package are not executed.

workspace-governance