The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes several local shell scripts to manage project state, Git worktrees, and run ledgers. These scripts include robust error handling (set -euo pipefail) and path validation to ensure operations remain within the designated project root.
Evidence: SKILL.md invokes scripts like scripts/oracle_init.sh and scripts/oracle_sandbox_worktree.sh.
[DATA_EXFILTRATION]: While the skill manages sensitive configuration files (.env), it implements a strict security policy. It only allows copying specific top-level .env patterns to isolated worktrees, enforces 0600 file permissions, verifies files are Git-ignored in the source repository, and explicitly rejects symlinks to prevent credential harvesting or unauthorized access.
Evidence: Found in scripts/oracle_sandbox_worktree.sh logic for environment file handling.
[PROMPT_INJECTION]: The skill ingests external data from the user's codebase (e.g., human.md, source code, documentation) which constitutes an indirect prompt injection surface. This risk is effectively mitigated by the skill's orchestration architecture, which mandates the use of fresh, independent threads for implementation, testing, and review to prevent adversarial content from influencing the entire workflow.
Evidence: Role definitions and "Real Thread Orchestration" instructions in references/orchestration.md and references/quality-delivery.md.

oracle