The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes Git commands using a bundled Python script scripts/inspect_repository.py.
The implementation uses subprocess.Popen with argument lists rather than shell strings, effectively preventing shell injection.
It sanitizes the process environment by clearing GIT_* variables (e.g., GIT_DIR, GIT_CONFIG_PARAMETERS) to prevent environment-based hijacking.
Target paths are resolved to absolute paths before execution to prevent flag injection attacks.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from Git repositories which could be manipulated by an attacker to influence the agent.
Ingestion points: The script scripts/inspect_repository.py reads data from the repository using symbolic-ref, for-each-ref, and status --porcelain (found in discover function).
Boundary markers: SKILL.md and references/contract.md provide clear instructions for the agent to distinguish between repository "facts," project "rules," and its own "suggestions," requiring manual verification for unverified states.
Capability inventory: The skill can execute various git subcommands via the run() function in inspect_repository.py. It specifically warns against automated pushes or destructive actions like reset --hard without explicit user authorization.
Sanitization: The Python script sets GIT_TERMINAL_PROMPT=0 and GIT_EDITOR=true to ensure Git commands remain non-interactive and do not trigger unexpected external processes.

git-commit