The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process arbitrary and potentially untrusted content from a repository to identify and report sensitive data hits to the agent.
Ingestion points: The scan, apply, and history commands read all files within a user-specified directory (root) using fs.readFileSync and git ls-files (in scripts/deid.mjs).
Boundary markers: The script implements a 'label' system, where sensitive values found in the code are referred to by user-defined labels in all console output and reports, preventing the PII itself from being leaked into the agent's context or logs.
Capability inventory: The script possesses capabilities to read and write local files (node:fs) and execute system commands (node:child_process).
Sanitization: Literal search strings are sanitized using an escapeRegExp helper before being incorporated into search patterns. Additionally, the script refuses to apply replacements that would introduce new sensitive needles.
[COMMAND_EXECUTION]: The script executes the git binary to perform file listing and history analysis.
Evidence: The git helper function in scripts/deid.mjs uses spawnSync('git', ['-C', root, ...args], ...).
Analysis: Command arguments are passed as an array to spawnSync without invoking a shell (shell: true is not used), which mitigates shell injection risks. The execution is strictly scoped to the git executable.
[DYNAMIC_EXECUTION]: The script dynamically creates regular expressions based on user-provided input in the needles file.
Evidence: In loadNeedles, the script calls new RegExp(row.regex ? row.value : escapeRegExp(row.value), ...).
Analysis: While this is a core requirement for the tool's functionality, providing raw regex strings from an external file represents a dynamic execution surface. The script mitigates this slightly by enforcing a minimum length for literal needles.

deid