The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructions in SKILL.md explicitly identify remote PR text, reviews, comments, and diffs as untrusted evidence. It strictly forbids these inputs from expanding scope, authorizing restacks, or requesting secrets.
Ingestion points: The skill reads PR data, reviews, and comments from GitHub and Graphite.
Boundary markers: The skill uses explicit instructional markers to define untrusted data and logical constraints on its use.
Capability inventory: Uses gt restack (Graphite), git worktree operations, and calls sub-skills for addressing comments and performing reviews.
Sanitization: Relies on structural constraints within the agent's instructions to prevent external data from influencing critical control flows.
[COMMAND_EXECUTION]: The skill performs legitimate repository management tasks using standard tools (git, gt). It invokes gt restack for Graphite stack updates and git worktree for environment management. These operations are scoped to the project and used for their intended purpose.
[SAFE]: The Python scripts in scripts/tests/ are used as linters to ensure that the SKILL.md file contains necessary safety and evidence-gathering instructions. They read the local SKILL.md file and perform regex checks to validate the presence of specific safety-critical phrases.

woostack-sweep