The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/generate_commit_msg.py script utilizes subprocess.run to call Git CLI tools. These calls are implemented using list-based arguments rather than shell strings, effectively mitigating risks associated with shell injection.
[INDIRECT_PROMPT_INJECTION]: The skill analyzes local repository data to suggest commit messages, creating a surface for processing untrusted content. 1. Ingestion points: The script scripts/generate_commit_msg.py reads data from git diff --cached and git log. 2. Boundary markers: No specific delimiters are used for the diff content. 3. Capability inventory: The script can execute a git commit operation via subprocess. 4. Sanitization: The script uses regex to sanitize potential scope names (removing non-alphanumeric characters) and relies on keyword matching. The potential for malicious influence is managed by the requirement for interactive user confirmation before any commit is finalized.
[PERSISTENCE]: The documentation provides instructions for setting up Git hooks (commit-msg and prepare-commit-msg) to automate workflow checks. This represents standard developer tooling usage and is intended for user-controlled local automation rather than hidden persistence.

git-workflow-skills