The Agent Skills Directory

[COMMAND_EXECUTION]: The utility executes shell commands to perform repository status checks and diagnostic probes.\n
Evidence: validate_packet.py uses subprocess.run(cmd, shell=True) within its run function to execute tasks like git operations and user-defined checks.\n
Mitigation: The script employs a strict string-matching allowlist. Command probes from untrusted input are only executed if they exactly match a command string pre-authorized in the local repository's .claude/session-boundary.json configuration file.\n
Evidence: In validate_packet.py, the validate_repository function verifies that any command probe from the packet exists in the allowed_commands set derived from local configuration before execution.\n- [INDIRECT_PROMPT_INJECTION]: The skill is specifically architected to mitigate indirect prompt injection from untrusted session packets.\n
Ingestion points: Untrusted metadata enters the agent context via the packet file path provided in $ARGUMENTS, which is subsequently read and parsed by validate_packet.py.\n
Boundary markers: The skill uses explicit SESSION-PACKET-V1 delimiters and instructs the agent to treat repository state as the higher authority over packet prose.\n
Capability inventory: The skill has the capability to execute shell commands (subprocess.run) and read/write repository files, but these are constrained by the validator's allowlist logic.\n
Sanitization: The validator performs rigorous checks: it matches Git HEAD and branch against the actual repository, uses regex (SECRET_PATTERNS) to block packets containing credentials, and rejects any packet containing unfinished work markers like 'TODO' or 'TBD'.

im-up