The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/merge-intel-report.sh executes multiple Git commands, including git log, git diff, and git rev-parse, using user-provided repository paths and branch references. While these are read-only operations, they involve executing shell commands with user-influenced arguments.\n- [EXTERNAL_DOWNLOADS]: The skill performs git fetch --all on the target repositories. Depending on the remote configuration of these repositories, this may result in network connections to external Git hosting services.\n- [DATA_EXFILTRATION]: The skill processes repository history, commit messages, and file structures to produce a report. Although it includes redaction logic for common secrets (like .env files and authentication tokens), it inherently exposes metadata and historical data from the codebase to the AI agent's context.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from Git commit messages and file names. A malicious contributor could craft commit messages containing instructions meant to be executed by the AI agent when it processes the generated report.\n
Ingestion points: Git commit messages via git log and file status via git status in scripts/merge-intel-report.sh.\n
Boundary markers: The output is encapsulated in Markdown code blocks within the report template to separate it from instruction text.\n
Capability inventory: The skill facilitates merge planning and report generation, requiring the agent to interpret summarized data.\n
Sanitization: The script includes redaction for known sensitive patterns (e.g., AWS keys, GitHub tokens) but does not escape Markdown formatting characters that could be used for injection.

git-merge-report