The Agent Skills Directory

[COMMAND_EXECUTION]: The GitWorkflowManager Python class in SKILL.md interacts with the local Git repository using subprocess.run. It correctly implements the list-of-arguments format for command execution, which prevents shell injection vulnerabilities.
[COMMAND_EXECUTION]: The GitHookInstaller class writes shell scripts directly to the .git/hooks/ directory. This behavior is necessary for the skill's stated purpose of automating commit message validation and push protections. The content of the hooks is restricted to local validation logic and does not involve network operations.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from the local repository (e.g., via git log) to generate changelogs. This represents a potential surface for indirect prompt injection if a repository contains malicious commit messages intended to influence the agent's behavior. However, the skill only uses this data for metadata extraction and formatting.
Ingestion points: SKILL.md (methods like changelog_between and get_latest_tag read from Git).
Boundary markers: Absent in the prompt templates.
Capability inventory: Filesystem writes and subprocess execution across SKILL.md.
Sanitization: The skill employs regex validation within its Git hooks to ensure data conforms to expected patterns.

dev-loop-git-workflow