The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/analyze_diff.py executes local git commands using subprocess.run(). It follows security best practices by passing arguments as a list and avoiding the use of a shell (shell=True), which mitigates command injection risks. The --repo parameter allows specifying a repository directory, which is used as the execution context context via the cwd argument.
[PROMPT_INJECTION]: The skill analyzes git diff output, which constitutes an ingestion point for untrusted external data that could contain indirect prompt injections.
Ingestion points: The get_changed_files and get_diff_stats functions in scripts/analyze_diff.py ingest data from the local repository using git commands.
Boundary markers: Absent. The output does not wrap diff-derived data in security delimiters or 'ignore instructions' warnings.
Capability inventory: The skill can execute local git commands and produce text output that the agent is instructed to use for generating commit messages.
Sanitization: The script parses the git output to extract metadata (e.g., file statuses and change counts) to build a commit message, rather than outputting raw diff contents. The agent is also instructed to review and manually adjust the result, providing a human-in-the-loop validation step.

smart-commit-gen