The Agent Skills Directory

[SAFE]: The skill processes local coding transcripts to identify patterns. It includes a dedicated secret redaction mechanism in scripts/lib/patterns.mjs that proactively masks credentials, including AWS keys, GitHub tokens, and JWTs, before transcript content is presented to the LLM context.- [SAFE]: External command execution is limited to standard git operations and the skill's own internal management scripts. These are executed via execFileSync in a controlled manner, with no evidence of shell injection vulnerabilities or unauthorized network requests.- [SAFE]: A strict human-approval gate is enforced. The skill instructions and associated validation hooks (scripts/hooks/validate-plan.mjs) ensure that all generated skill candidates are presented to the user for explicit verification as 'dossiers' before any file-writing or installation occurs.- [SAFE]: The skill incorporates explicit defenses against indirect prompt injection by instructing the agent to treat extracted transcript content as inert data rather than instructions, supported by clear boundary markers and sanitization at the emit boundaries.

lore