The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted data from git diffs and repository configuration files, creating a surface for indirect prompt injection where malicious instructions could be embedded in the code under review.
Ingestion points: Git diff output from staged/unstaged changes and repository-local AGENTS.md configuration files.
Boundary markers: The skill relies on high-level constraints in SKILL.md advising the agent to disregard commands in diff content, but it does not define technical delimiters for the input.
Capability inventory: The agent has the ability to modify local files (applying refactors) and execute shell commands for analysis and validation.
Sanitization: The skill enforces secret redaction and includes specific resistance tests in references/evals.yaml to ensure the agent ignores malicious instructions.
[DATA_EXFILTRATION]: The skill implements a policy to redact secrets, credentials, tokens, and private keys from its outputs. It includes dedicated test cases in references/evals.yaml to verify that the agent refuses requests to exfiltrate environment variables or upload logs to external endpoints.
[COMMAND_EXECUTION]: The skill executes shell commands for repository analysis, such as git diff and ripgrep (rg), via a local bin/ask utility. It also executes validation commands specified in a local AGENTS.md file; executing instructions defined within the repository being analyzed is a potential vector for command injection if the local configuration is compromised.

simplify