The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes various system commands including git, npx wrangler, and npm run test across multiple phases. These are necessary for the skill's primary function of work recovery. Risks are mitigated by a non-destructive Phase 1-3 policy and a requirement for explicit human-in-the-loop approval before any recovery actions are executed in Phase 4.
[EXTERNAL_DOWNLOADS]: The skill uses curl to fetch metadata from user-configured deployment endpoints to compare local work against live environments. This activity is restricted to metadata (e.g., SHA hashes) and specifically instructs the agent to avoid including bearer tokens in the output, using environment variable references instead.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting and following instructions found in repository files like docs/worktree-journal.md and handoff documents. While these files are used to guide the discovery of stranded work, a malicious repository could contain crafted instructions to misguide the agent's recovery logic. The impact is minimized by the mandatory batch approval gate before any mutations occur.
[DATA_EXFILTRATION]: Although the skill reads repository content and makes network requests, it includes explicit rules for redacting credentials and scrubbing authorization headers from captured command output. This prevents accidental exposure of sensitive tokens or secrets during the ledger presentation phase.

sweep