The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from git logs, pull request comments, and AI session transcripts. It implements multi-layered isolation to mitigate injection risks:
Ingestion points: Untrusted data is ingested via scripts/extract_sessions.py (which processes local session logs) and git/GitHub CLI commands (processing PR and commit metadata) as defined in SKILL.md.
Boundary markers: Instructions explicitly mandate treating all external text as data/evidence, not as instructions. It further directs the agent to report any instructional text found within data as a security finding.
Capability inventory: Capabilities are focused on read-only access to git history and local log files. The skill performs network operations only via the official gh CLI to a well-known service (GitHub).
Sanitization: The skill utilizes shell-quoting for all variables derived from external data and employs a single-quoted heredoc (<<'QUOTE') for its transcript verification logic, which prevents variable expansion and command injection into the shell environment.
[COMMAND_EXECUTION]: The skill executes local development tools including git and gh. These operations are limited to data retrieval and use secure argument passing (list-based subprocess calls) to prevent shell injection or arbitrary command execution.
[DATA_EXFILTRATION]: The skill accesses sensitive local files, specifically AI agent session logs from Claude, Codex, and OpenCode located in user home directories. Access is restricted to the local filesystem; the script is read-only and designed to extract only human-to-agent signals. The resulting retrospective report is stored within the local repository and contains only agent-generated summaries, with explicit rules forbidding the inclusion of secrets or raw untrusted text.

code-retro