The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes historical conversation transcripts, which are untrusted inputs that could contain malicious instructions.
Ingestion points: Data is ingested from the git-ai search command output and via the Read tool for source files.
Boundary markers: The prompt template does not use specific delimiters or instructions to ignore potential commands within the retrieved transcript.
Capability inventory: The subagent is limited to Bash (specifically whitelisted to git-ai:*) and Read tools with a maximum of 4 turns.
Sanitization: No content sanitization or validation is performed on the historical transcripts before processing.
[SAFE]: The skill incorporates multiple defensive layers. It uses a strictly whitelisted Bash tool limited to git-ai subcommands, preventing arbitrary command execution. It employs a low-privilege subagent for actual information retrieval and explicitly forbids access to sensitive agent metadata directories such as .claude/ and .agents/.

ask