The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it utilizes the agent to perform a 'Layer 4 AI semantic review' on potentially untrusted data from a Git repository's history. An attacker could embed malicious instructions in commit messages or code comments to manipulate the agent's behavior during this review phase.
Ingestion points: The scripts/scan_repo.py and scripts/verify_cleanup.py scripts ingest data from all commits in the repository history via git grep and git rev-list commands.
Boundary markers: The AI review template in references/ai_semantic_review_prompt.md lacks strong isolation mechanisms (such as unique random delimiters or XML-based encapsulation) to distinguish between instructions and the data being analyzed.
Capability inventory: The agent has the capability to rewrite repository history via scripts/rewrite_history.py and push changes to remote repositories using scripts/safe_push.py.
Sanitization: No automated sanitization or escaping of the repository content is performed before it is provided to the AI for semantic analysis.
[COMMAND_EXECUTION]: All bundled Python scripts (scan_repo.py, rewrite_history.py, verify_cleanup.py, safe_push.py) utilize subprocess.run() to execute local shell commands. The scan_repo.py script specifically reads regex patterns from a .pii-patterns file located in the repository root and passes them as arguments to git grep, which could be exploited by an attacker to trigger unintended behavior or denial of service via complex patterns.
[DATA_EXFILTRATION]: To perform its intended security cleanup function, the skill accesses sensitive local file paths, including ~/.config/github-sensitive-data-cleanup/identities.txt and user-provided private gitleaks configuration files. While this is necessary for the skill's primary purpose, it involves the handling of sensitive system data by the agent.
[EXTERNAL_DOWNLOADS]: The skill instructions guide the user to install several well-known security and development tools, such as gitleaks, git-filter-repo, and the GitHub CLI (gh), through the Homebrew package manager.

github-sensitive-data-cleanup