The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes a bundled Python validation script (scripts/validate_adrs.py) that interacts with the local Git repository.
Evidence: The script uses subprocess.run to call git cat-file for verifying commit hashes provided in documentation.
Safety Analysis: Command execution is performed securely using an argument list, which prevents shell injection. Additionally, any input from the processed files (commit hashes) is strictly validated against a restrictive hexadecimal regular expression ([0-9a-f]{7,40}) before use, ensuring no malicious strings can reach the underlying command.
[DATA_EXFILTRATION]: No network access or data exfiltration patterns were detected. The skill instructions specifically include a quality rule to "Keep secrets, personal data, and internal credentials out of evidence," which reduces the risk of sensitive information being accidentally included in the documentation logs.
[REMOTE_CODE_EXECUTION]: No remote dependencies or dynamic code execution patterns were identified. The skill relies entirely on its local bundled script and standard system tools like Python and Git.
[PROMPT_INJECTION]: The skill body consists of professional architectural guidelines and does not contain instructions aimed at bypassing agent safety filters or overriding system instructions.

architecture-decision-records