The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess to execute git log commands across several scripts, including build_ownership_map.py, community_maintainers.py, and run_ownership_map.py.
These calls are implemented using list-based arguments without shell=True, which is a secure practice that prevents shell injection.
The commands are used for the intended purpose of extracting repository history for ownership analysis.
[EXTERNAL_DOWNLOADS]: The skill documentation specifies the use of the networkx Python package for graph processing.
networkx is a well-known, legitimate library used for community detection and graph exports.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface through its parsing of repository data.
Ingestion points: Git log output is ingested and processed in scripts/build_ownership_map.py to identify identities and file changes.
Boundary markers: The parser relies on a simple string delimiter (---) to separate commit entries. If a commit message or file path contains this sequence, it could cause schema confusion and corrupt the resulting ownership topology.
Capability inventory: The skill scripts generate JSON/CSV artifacts and execute the git binary.
Sanitization: No escaping or validation is performed on commit content before parsing based on the delimiter, which allows a crafted repository to influence the security findings reported to the agent.

security-ownership-map