The Agent Skills Directory

[DATA_EXFILTRATION]: The catalog/rebase-worktrees.md file contains instructions to read and synchronize keys from .env files across different git worktrees. These files are a known sensitive path typically containing credentials, API keys, and other environment secrets.
[DATA_EXFILTRATION]: The catalog/commit-detail.md file uses the command git add -A, which stages every change in the working directory. This increases the risk of accidentally committing and exposing sensitive files, local configuration, or secrets that are not properly excluded by the project's .gitignore file.
[EXTERNAL_DOWNLOADS]: The catalog/rebase-worktrees.md workflow automatically detects project lockfiles (bun.lockb, pnpm-lock.yaml, yarn.lock, package-lock.json) and executes the corresponding package installation commands. This results in the downloading and execution of external dependencies from public registries.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted code content from the repository which could contain malicious instructions designed to influence the agent's behavior during refactoring or conflict resolution.
Ingestion points: Untrusted data enters the context via git diff and git show commands in catalog/code-simplify.md and catalog/resolve-conflict.md.
Boundary markers: The instructions lack explicit delimiters or "ignore embedded instructions" warnings when processing code content.
Capability inventory: The skill has the capability to write files, stage git changes, and execute arbitrary project scripts via linting/typechecking commands.
Sanitization: There is no evidence of sanitization or filtering of the code content before it is processed by the agent or subagents.
[COMMAND_EXECUTION]: The skill executes a wide range of shell commands, including git plumbing/porcelain commands, package managers, and dynamically identified project scripts (e.g., npm run lint).

qwe