The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on bundled Python scripts (render_patch.py and emit_evidence_bundle.py) which use the subprocess module to execute git commands. These commands are necessary for repository analysis (e.g., git show, git rev-parse). The scripts implement rigorous security checks, including verifying that Git revisions are exactly 40-character hex strings and ensuring repository-relative paths do not traverse parent directories using '..' components.
[INDIRECT_PROMPT_INJECTION]: By design, the skill ingests and analyzes content from untrusted repositories, which creates a potential surface for indirect prompt injection. A malicious repository could contain instructions intended to misguide the agent. The skill addresses this risk through several architectural constraints:
Ingestion points: The agent reads arbitrary files from the target repository, including AGENTS.md and developer documentation.
Boundary markers: The skill uses explicit machine-readable markers (e.g., ONBOARDING_PATCH:H1:BEGIN) to delimit its own generated output and proposes changes only within defined 'managed markers' in existing files.
Capability inventory: The skill's capabilities are limited to local file system reads, Git inspections, and evidence bundle generation. It explicitly prohibits installing tools, starting services, or creating state during its initial pass.
Sanitization: The accompanying Python scripts sanitize inputs by enforcing strict path patterns and revision formats, reducing the risk of command injection through repository metadata.

onboard-repository