The Agent Skills Directory

[SAFE]: The skill implements a robust 'Security Self-Check' mechanism (Step 6.5 in SKILL.md) which proactively scans for high-entropy strings, API keys, and credentials, redacting them before any documentation is written to disk.
[SAFE]: To mitigate the risk of indirect prompt injection from codebase content or external discussion history, the skill uses an 'Audit Pass' (detailed in references/audit-pass.md). This pass employs a dedicated analysis subagent that is intentionally isolated from the original untrusted input data to objectively judge the safety and relevance of the extracted rules.
[SAFE]: The bundled utility script scripts/extract_session_messages.mjs is a benign tool for parsing local Claude Code session history logs. It uses standard Node.js APIs and includes output limiting to prevent potential resource exhaustion.
[SAFE]: Integration with GitHub for PR review extraction utilizes the official gh CLI and requires existing user authentication. The data fetched is strictly limited to review comments for the purpose of identifying organizational coding preferences.
[SAFE]: Maintenance modes such as 'Restructure' and 'Compaction' are well-defined tasks that operate exclusively on local rule files with explicit user confirmation gates for any structural changes.

extract-rules