The Agent Skills Directory

[DATA_EXFILTRATION]: The skill incorporates a sophisticated redaction engine in references/defer-mutation.js. This engine automatically identifies and masks credentials (e.g., Atlassian tokens, GitHub PATs, Bearer tokens) in environment variables and command arguments, ensuring sensitive data is not leaked into local handover records or committed documentation.
[COMMAND_EXECUTION]: Command execution is tightly controlled. The skill performs a 'verification pass' via references/handover-verify.js using a strict allowlist of read-only operations (e.g., git ls-remote, gh issue view). Full command execution (via --apply) is only permitted when the system's access policy is explicitly set to full and commands are read from locally committed handover artifacts.
[DYNAMIC_EXECUTION]: Shell scripts in references/resolve-platform.sh use eval for variable expansion. This usage is safe as it is restricted to a narrow, hardcoded set of internal keys ('tracker' and 'vcs'), preventing arbitrary input from reaching the execution context.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it processes external data from handover sidecars (*.handover.*.json).
Ingestion points: Handover sidecar files are read and processed in scripts/tracker-reconcile.js.
Boundary markers: Commands and states are parsed according to a specific JSON schema defined in references/tracker-access-record.md.
Capability inventory: The skill can execute commands via execFileSync when the --apply flag is used.
Sanitization: Inputs are verified against the tracker state before execution, and the skill is designed for the primary purpose of managing these commands as part of a developer-controlled maintenance workflow, effectively mitigating the risk.

tracker-reconcile