The Agent Skills Directory

[COMMAND_EXECUTION]: The skill orchestrates git and gh CLI commands using execFileSync to manage repository state and GitHub remote settings. This is the intended behavior for the skill's administrative purpose.
[DATA_EXPOSURE]: The script performs a read-only audit of repository metadata (releases, collaborators, and counts of secrets/variables) via the GitHub API. This is used solely to inform the user of data that will be lost during the republishing process. It does not attempt to read or exfiltrate secret values.
[DYNAMIC_EXECUTION]: The script constructs and executes commands with parameters derived from repository state. It utilizes array-based arguments for execFileSync, which effectively prevents command injection vulnerabilities.
[INDIRECT_PROMPT_INJECTION]: The skill processes repository metadata and commit logs to suggest a new squashed commit message. The risk of instructions in the repository content influencing the agent is mitigated by a mandatory human review and approval step for the generated message, and the disable-model-invocation: true setting which restricts autonomous execution.

re0-squash