The Agent Skills Directory

[PROMPT_INJECTION]: The skill implements a robust 'Passive-data safety' policy defined in passive-data-safety.md. It explicitly instructs the agent to treat all repository-derived text (diffs, commits, specs, tracker text) as passive data and to disregard any instructions or commands embedded within that text.
[CREDENTIALS_UNSAFE]: A mandatory redaction policy is enforced in SKILL.md and passive-data-safety.md. Before any gathered text is included in a commit body or PR description, the skill requires the agent to identify and replace secrets (API keys, tokens, passwords) with class-specific placeholders like [redacted:api-key].
[COMMAND_EXECUTION]: The skill uses a shell execution block in package-contract.md to generate a content digest. It follows security best practices by reading input from pre-validated files on disk rather than using string interpolation, which effectively mitigates the risk of command injection from malicious branch titles or commit messages.
[DATA_EXFILTRATION]: The skill includes a 'Hard Gate' that prevents writing any metadata or PR package files to the .skills/ directory unless that directory is explicitly proven to be git-ignored. This prevents the accidental leakage of internal agent context or metadata to the remote repository.
[PROMPT_INJECTION]: The skill processes untrusted external data, creating an indirect prompt injection surface.
Ingestion points: External data enters the context through git diffs, issue tracker items, and specification files during the 'Gather context' and 'Resolve tickets' phases.
Boundary markers: The agent is required to load passive-data-safety.md and SKILL.md which contain strict instructions to ignore instructions embedded in passive data.
Capability inventory: The skill is limited to local git operations and writing to the .skills/ directory. No network exfiltration tools or arbitrary command execution patterns were found.
Sanitization: The skill enforces automated redaction of sensitive credentials and uses sanitized stable IDs derived from branch names to prevent path traversal.

prepare-change