The Agent Skills Directory

[DATA_EXPOSURE]: The skill implements a comprehensive redaction engine in references/defer-mutation.js. This engine automatically detects and replaces sensitive credentials (tokens, passwords, API keys) with environment variable names or generic masks before any tracker action is logged or displayed to the user.
[PRIVILEGE_ESCALATION]: Access controls are managed via a centralized resolver (references/resolve-platform.sh) that implements a 'most restrictive wins' policy. This ensures that even if an environment variable attempts to broaden access, a more restrictive project-level configuration (skills-config.yaml) will take precedence.
[REMOTE_CODE_EXECUTION]: Configuration parsing uses a two-tier approach. It attempts to use python3 with pyyaml for full parsing but executes with hardened settings (e.g., stripping the current directory from the Python path to prevent module shadowing) and uses argument passing instead of string interpolation to prevent injection. It falls back to a limited, non-executable awk-based parser if Python is unavailable.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from an 'Observation Log'. This ingestion surface is protected by deterministic validation logic in scripts/lib.js and the seed-args guard, which strictly enforces that task IDs and observation references consist only of numeric digits, preventing shell or command injection during the seeding process.
[COMMAND_EXECUTION]: External tool invocations (such as gh or git) are performed using standardized wrappers that respect the resolved access tier. Non-GET operations to external trackers are deferred to user-approved scripts or manual instructions when the agent is in a restricted access mode.

create-task