The Agent Skills Directory

[COMMAND_EXECUTION]: The workflow check subcommand, documented in references/check-evidence.md, enables the agent to execute arbitrary binaries on the host system. While intended for legitimate development tasks like running linters, tests, or build scripts (e.g., npm run verify), this provides a powerful execution primitive. The skill attempts to mitigate risk by using a bundled launcher that avoids shell interpretation, but the capability remains a significant security surface.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze workspace file content and user-provided hints to generate commit messages and rationales (referenced in SKILL.md and references/inspection-recovery.md). Because the agent possesses powerful capabilities—such as command execution and network operations via Git—malicious instructions embedded in the files being analyzed could potentially influence the agent's behavior. The instructions lack explicit boundary markers or warnings for the agent to disregard instructions found within the data it processes.
Ingestion points: The skill reads file contents during the workflow prepare and workflow review-next phases to establish commit scope and generate message rationales.
Boundary markers: No specific delimiters or safety instructions are provided to help the agent distinguish between data and instructions within the repository files.
Capability inventory: The skill has the ability to execute arbitrary commands (workflow check) and perform network operations via Git and the GitHub CLI (workflow publish).
Sanitization: The skill instructions do not specify any validation or sanitization of file content before the agent interprets it for drafting messages.

committing-to-git