The Agent Skills Directory

[COMMAND_EXECUTION]: Several scripts, including direct-gh-glab-usage.py, check-manifest-consistency.py, and check-routing-decisions.py, utilize subprocess.run to execute local git commands (e.g., git diff, git rev-parse). These calls are used to compute the plan footprint and verify deliverables, which is necessary for the audit functionality. The usage is constrained to repository analysis within the plan's context.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from work.log, solution_outline.md, and session transcripts (~/.claude/projects/). It implements a 'Two-Tier Degradation Path' in references/chat-history-analysis.md and extract-chat-signal.py to filter signals and skip transcripts that exceed a 2 MiB budget, mitigating risk when analyzing large or potentially adversarial user-provided logs. (Severity: LOW).
[DATA_EXFILTRATION]: The skill accesses local metadata, logs, and session history to compile reports. No network exfiltration patterns, hardcoded credentials, or connections to untrusted external domains were identified.
[SAFE]: The design intent follows a 'scripts never judge; references never run code' model. Structured data exchange via TOON/JSON ensures that the LLM synthesis phase is based on deterministic facts, minimizing the execution surface for malicious content hidden in plan artifacts.

plan-retrospective