The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill acknowledges the attack surface created by ingesting untrusted data from issues, PR reviews, and CI logs. It implements a robust "Retrieved Evidence Boundary" that explicitly instructs the agent to treat such content as data only, not as authoritative instructions, effectively mitigating injection risks. The skill further sanitizes the workflow through a required approval checkpoint system before any repository changes are executed.
[CREDENTIALS_UNSAFE]: The instructions mandate secure credential handling by strictly forbidding the storage of usernames, passwords, tokens, or session values in persistent chat artifacts or seed files. It enforces the use of ephemeral runtime inputs, preventing accidental credential exposure.
[COMMAND_EXECUTION]: The skill implements a secure mutation protocol where all local implementations and commits are gated by user approval. It maintains a clear boundary between local authority and remote operations, explicitly excluding dangerous actions like remote pushing or merging from its scope.
[PRIVILEGE_ESCALATION]: The skill enforces workspace safety by requiring task isolation through worktrees or fresh checkouts. It includes verification steps to ensure task branches do not inadvertently track or modify sensitive integration branches, adhering to the principle of least privilege.

tk-prep