The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses an inherent attack surface as it ingests untrusted data from the Git environment, such as repository files, branch names, and commit messages. Specifically, the instructions to "Preserve user-provided commit text verbatim" (in checklist.md) could allow a malicious user to embed instructions within a commit message that might be misinterpreted by the agent during subsequent processing. However, the skill implements robust mitigations by requiring explicit human authorization for every mutation and mandating detailed reporting of all actions.
Evidence Chain:
Ingestion points: Git repository content, commit messages, and branch names (referenced in references/checklist.md and references/usage.md).
Boundary markers: The skill instructions emphasize reporting "every unverified boundary" and "residual Worktree" state, maintaining clear visibility of what is and isn't within the approved scope.
Capability inventory: The skill has extensive write capabilities including git commit, git push, git rebase, and execution of local validation scripts/tests (referenced in references/checklist.md and references/skills-release.md).
Sanitization: The reporting guidelines in references/delivery-report.md explicitly require the redaction of tokens, credentials, and private payloads.
[COMMAND_EXECUTION]: The skill is designed to execute shell-level Git commands and repository-defined validation scripts (e.g., "canonical repository gate" and "executable tests" in references/skills-release.md). These executions are legitimate functions for a repository delivery tool and are gated by strict requirements for user authorization and prior review evidence.

repo-delivery