The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted repository data including diffs, commit messages, and branch names which could potentially contain malicious instructions.
Ingestion points: scripts/lib/review-evidence.mjs (diff and file content), scripts/lib/evidence-stashes.mjs (stash metadata).
Boundary markers: Implements nonce-based delimiters (<<<EXTERNAL_DATA_START:${nonce}>>>) to frame and isolate untrusted content from the system prompt.
Capability inventory: The skill can perform Git deletions and worktree removals, and interface with GitHub via the gh CLI, though all destructive actions require explicit user approval.
Sanitization: Features a comprehensive sanitization layer in scripts/lib/review-bundle.mjs that redacts credential patterns and filters unsafe control characters.
[COMMAND_EXECUTION]: The skill invokes the git and gh CLI tools to analyze and manage the repository.
Security controls: It uses a strict allow-list of approved Git argument patterns and verifies that executables are located in trusted system directories, preventing the execution of arbitrary or repository-local binaries.
[DYNAMIC_EXECUTION]: The skill executes internal Node.js utility scripts (scripts/triage.mjs and scripts/apply-review.mjs) to process data and apply policy.
Control: These scripts are bundled with the skill and are executed without a shell, using secure JSON communication over stdin/stdout.

git-tidy