The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocesses to perform Git and GitHub operations and execute user-defined validation steps.
It utilizes subprocess.Popen and subprocess.run with list-based arguments to avoid shell injection vulnerabilities across various scripts including changeset.py, git_ops.py, and github_ops.py.
Robust credential redaction is implemented via redact_credentials in scripts/git_ops.py to prevent sensitive information from appearing in logs or being returned to the agent.
[INDIRECT_PROMPT_INJECTION]: The skill operates by ingesting decision and gate packets that define executable command vectors.
Ingestion points: Command vectors are read from JSON files provided via the --gates and --policy arguments in scripts/ship.py.
Boundary markers: Boundary markers or delimiters are not explicitly enforced for the commands themselves, relying on the model's adherence to the specified JSON schema.
Capability inventory: The skill has the capability to execute arbitrary command vectors (subprocess.Popen), write to the local filesystem (journals), and communicate with the GitHub API via the gh CLI.
Sanitization: The skill performs credential redaction on command output but does not sanitize or restrict the command vectors themselves, which could be exploited if an attacker manages to influence the AI's generated output.
[DYNAMIC_EXECUTION]: The skill uses dynamic library loading for system inspection.
In scripts/git_ops.py, ctypes.CDLL is used to load /usr/lib/libproc.dylib on macOS to inspect the process table. This is used for a safety check to ensure a worktree is not the current working directory of any process before deletion.

ship-workflow