The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a wide array of shell commands to collect repository data.
Evidence includes calls to git, gh (GitHub CLI), find, grep, wc, and sort to extract branch info, commit history, and codebase statistics.
[DYNAMIC_EXECUTION]: The skill runs project-specific executable content to verify project health.
It executes test runners such as npx vitest, npm test, cargo test, pytest, and go test.
It runs compilers and type-checkers like npx tsc, mypy, cargo check, and go vet.
[CREDENTIALS_UNSAFE]: The skill actively searches for and reports hardcoded sensitive information to the user.
It uses git grep to find patterns matching PRIVATE_KEY, SECRET_KEY, API_KEY, PASSWORD, TOKEN, and Bearer tokens.
It specifically checks if .env files are tracked in the version control system.
[EXTERNAL_DOWNLOADS]: The skill instructions allow for the silent installation of project dependencies.
It directs the agent to "Install dependencies first if needed (check for node_modules, etc.) but do so silently," which may trigger downloads from public registries like NPM or PyPI.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect injection by processing untrusted repository data.
Ingestion points: Commit messages, README.md files, and source code content (scanned for TODO/FIXME markers).
Boundary markers: None specified; content is interpolated directly into the report.
Capability inventory: Extensive shell execution and project code execution (tests/compilers).
Sanitization: No explicit sanitization or escaping of the ingested file content is mentioned before it is presented in the report.

git-project-status