The Agent Skills Directory

[SAFE]: The skill implements a robust security scanning mechanism in scripts/lib/catalog.mjs that identifies high-risk files (e.g., .env, private keys) and sensitive content patterns (e.g., API keys, database connection strings) within the project to be archived.\n- [SAFE]: By default, the discover phase (scripts/phases/discover.mjs) automatically marks high-risk files for exclusion from the handoff package, requiring explicit user intervention to include them, which minimizes accidental data exposure.\n- [SAFE]: Session extraction from various harnesses (Claude Code, Codex, Kimi, Hermes) is performed through dedicated adapters. The Hermes adapter uses a Python bridge (scripts/lib/hermes_sqlite.py) which enforces read-only access and employs identifier quoting to mitigate SQL injection risks.\n- [SAFE]: Hardcoded credentials found in the repository (e.g., in scripts/fixtures/sample-project/.env) are clearly identified as test fixtures for validation of the skill's own security scanner and do not represent actual secrets or vulnerabilities in the skill itself.\n- [SAFE]: The skill uses a multi-phase workflow with human-in-the-loop checkpoints (GATES) described in SKILL.md, ensuring that users can review the file inventory and session digests before final package generation.

document-handoff