The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from git command outputs to generate commit messages, creating an indirect injection surface.
Ingestion points: Untrusted data enters the context via git status, un-staged diffs, and staged diffs as described in SKILL.md.
Boundary markers: The workflow explicitly separates analysis, preview, and execution phases, requiring the agent to confirm the staged set before proceeding with a commit.
Capability inventory: The skill can perform git commits, git staging, and write configuration records via the scripts/profile_store.py utility.
Sanitization: The profile_store.py script provides sanitization by blocking the persistence of fields containing sensitive keywords like 'token' or 'secret'.
[EXTERNAL_DOWNLOADS]: The README.md file includes installation instructions via npx for the lov-git-commit-with-context package. This resource aligns with the vendor's naming convention and is used for standard skill deployment.
[SAFE]: The scripts/profile_store.py utility implements security best practices by enforcing a strict whitelist for profile root sections ('user', 'brand', 'workspace', 'preferences') and setting file permissions to 0o600 (read/write by owner only) during atomic updates.
[SAFE]: The skill's validation script (scripts/validate_skill.py) uses yaml.safe_load, protecting against common YAML deserialization attacks during the skill's development and testing phase.

lov-git-commit-with-context