The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill is designed to identify and execute linting commands found within repository configuration files, such as .github/workflows/*.yml, package.json, Makefile, and justfile. This involves the runtime assembly and execution of shell strings derived from untrusted local files.
[INDIRECT_PROMPT_INJECTION]: The process of extracting and executing commands from project files creates a significant surface for indirect injection if an attacker-controlled repository contains malicious shell commands in its configuration.
Ingestion points: Project configuration files including .github/workflows/*.yml, .gitlab-ci.yml, .pre-commit-config.yaml, Makefile, justfile, and package.json (Step 3).
Boundary markers: None; the skill assumes commands extracted from these files are safe and legitimate.
Capability inventory: Shell execution of extracted commands using project runners (e.g., uvx, npm run) and potentially modifying files if the user accepts suggested linting fixes.
Sanitization: No validation, escaping, or filtering is performed on the extracted command strings before execution.
[COMMAND_EXECUTION]: The skill relies heavily on shell command invocation for Git operations, including index snapshots (git write-tree), history analysis (git log), and commit creation with heredocs.

generate-commit