The Agent Skills Directory

[COMMAND_EXECUTION]: The skill extensively uses shell commands to interact with Git, SpecStory, Gitleaks, and system utilities like lsof.
Scripts such as _post_session.py, stage-agent-artifacts.sh, and scan-staged.sh execute git commands for repository discovery, staging, and commit validation.
run-specstory-session.sh executes the specstory CLI to manage agent sessions.
[PERSISTENCE]: The bootstrap-project.sh script installs Git hooks (specifically pre-commit and optionally prepare-commit-msg) into the local repository.
This is a core part of the skill's functionality to ensure that history hygiene checks are enforced during the commit workflow.
[INDIRECT_PROMPT_INJECTION]: The skill parses untrusted data from agent transcripts (.specstory/history/*.md) to derive commit metadata.
Ingestion points: scripts/agent-commit-metadata.sh and scripts/find-session.sh read transcript files.
Boundary markers: Present (scripts look for specific SpecStory header markers, e.g., ).
Capability inventory: All subprocess calls (git), file-write, and network operations across scripts are performed for maintenance and verification purposes.
Sanitization: Strict regex matching and path validation are performed on all extracted fields to prevent injection into commit trailers.
[EXTERNAL_DOWNLOADS]: bootstrap-project.sh and the pre-commit configuration templates reference the author's public repository (https://github.com/daviddwlee84/agent-skills) for pre-commit hook definitions.
These references are to vendor-owned resources and are used for standard dependency management within the pre-commit framework.

agent-history-hygiene