The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local git and gh CLI commands to manage the development workflow (e.g., branching, pushing, and merging).
[COMMAND_EXECUTION]: The skill performs dynamic command execution by identifying and running project-specific test suites based on file markers (e.g., cargo test, go test, npm test, pytest).
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from the repository's configuration files to determine which commands to run. This vulnerability surface is mitigated by the requirement to print an execution plan and the use of standard build tools. Ingestion points: package.json, Cargo.toml, pyproject.toml, go.mod, Gemfile, justfile, Makefile. Boundary markers: --dry-run flag and mandatory execution plan printing. Capability inventory: git, gh, and language-specific test runners. Sanitization: Human-in-the-loop prompts for detected secrets and execution failures.
[DATA_EXFILTRATION]: The skill includes a proactive security feature called a 'Secrets gate' (Step 3a) which uses git diff to scan for patterns associated with sensitive credentials (such as sk-, ghp_, or private key headers) and prevents them from being staged or committed without explicit user confirmation.

ship