The Agent Skills Directory

[PROMPT_INJECTION]: The skill manages a surface for indirect prompt injection via pull request comments and CI logs.
Ingestion points: Pull request descriptions, reviewer comments, and CI logs are read into the agent context from the external project forge.
Boundary markers: Instructions explicitly define all remote content as untrusted, inert data that must not influence agent policy or instructions.
Capability inventory: The agent possesses shell access (Bash), sub-skill invocation (Skill), and file system access (Read).
Sanitization: Untrusted data must be quoted and escaped to prevent its content from being interpreted as instructions by the model.
[COMMAND_EXECUTION]: Git operations such as adding, committing, and resetting files are performed using system-level tools.
Sanitization: The implementation uses the '--' separator in shell commands to prevent untrusted filenames from being interpreted as command flags.
[CREDENTIALS_UNSAFE]: A built-in security process scans all code changes and metadata for high-confidence secrets before any commit or push occurs.
Mitigation: Secrets found in metadata are redacted using HMAC-SHA-256 before transit.
[DATA_EXFILTRATION]: Local state (the run ledger) is protected from unauthorized local access.
Evidence: Files are created with mode 0600 (read/write for owner only) and directories with mode 0700.

player-coach