The Agent Skills Directory

[COMMAND_EXECUTION]: The GitClient in src/clients/git.py executes system commands via subprocess.run to perform local git forensics. This implementation includes extensive security hardening measures:
Input validation using strict regex for SHAs and branch names (_validate_sha, _validate_ref).
Use of --end-of-options to prevent argument injection attacks from malicious repository content.
Environment scrubbing (_safe_git_env) to drop sensitive or dangerous variables like LD_PRELOAD and GIT_SSH.
Mandatory git configuration overrides via -c flags to disable dangerous features (e.g., core.fsmonitor, core.hooksPath, credential.helper) that could be abused by a malicious repository.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from GitHub sources (issue bodies, pull request descriptions, and commit messages), which presents an indirect prompt injection surface.
Ingestion points: Data enters the system via GitHubAPICollector (src/collectors/api.py) and GHArchiveCollector (src/collectors/archive.py).
Boundary markers: SKILL.md includes explicit instructions for the agent to treat quoted evidence content strictly as data and to ignore any instruction-shaped text within it.
Capability inventory: The skill can execute local git commands, perform network requests to GitHub/Wayback APIs, and write evidence files to a local directory.
Sanitization: Robust validation of file paths and branch names in the schema (src/schema/common.py) and percent-encoding of all URL segments in the GitHub client (src/clients/github.py) prevent malicious data from manipulating subsequent system operations or re-addressing API requests to attacker-controlled repositories.

github-evidence-kit