The Agent Skills Directory

[DATA_EXFILTRATION]: The scripts/smart_commit.sh script executes git add . followed by an automatic git push, which automatically stages and uploads all modified files in the repository. This behavior creates a significant risk of accidentally exfiltrating sensitive local data (such as .env files, SSH keys, or API tokens) to a remote branch if they are not explicitly excluded by a .gitignore file.
[COMMAND_EXECUTION]: The workflow relies on a single bash script that bundles staging, committing, and pushing operations into a single execution step. This automation bypasses standard safety checkpoints where a user or agent would review the specific files being staged before they are committed and pushed to a remote server.
[DATA_EXFILTRATION]: There is a direct logical contradiction between the safety instructions in SKILL.md (which instruct the agent never to stage secret files) and the actual implementation in smart_commit.sh (which stages everything automatically). An agent following the skill's primary instruction to 'ALWAYS use the script' will inadvertently violate the safety constraints regarding secret files. Ingestion points: Local repository files and git diff output. Boundary markers: None present in the script execution flow. Capability inventory: git add, git commit, and git push via shell subprocess. Sanitization: None; the script uses an unselective git add . command.

git-pushing-hardened