The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes command strings provided to tools, which are considered untrusted data from the agent's context.
Ingestion points: scripts/block-dangerous-git.sh and scripts/classify_git_command.py read command data from standard input.
Boundary markers: None are implemented for the command strings.
Capability inventory: The scripts are limited to logic checks and exit code responses; they do not possess file-writing or network-access capabilities.
Sanitization: Data is parsed using standard JSON libraries, and content is evaluated using regular expressions.
[PERSISTENCE]: The skill installs itself as a persistent hook by modifying .claude/settings.json or ~/.claude/settings.json. This allows the safety guardrails to persist across agent sessions, which is the stated primary purpose of the skill.
[COMMAND_EXECUTION]: The installation process involves setting executable permissions on scripts and registering them for execution by the agent environment. These scripts perform the safety checks and do not execute external or user-provided commands themselves.

git-safety-guardrails