The Agent Skills Directory

[SAFE]: The skill is well-structured and follows defensive design principles. It explicitly separates behavior-preserving refactoring from functional changes and enforces a multi-phase workflow (Understand, Diagnose, Plan, Transform, Review) that requires user confirmation before code modifications.
[INDIRECT_PROMPT_INJECTION]: As a code-refactoring tool, the skill naturally ingests untrusted repository content. This attack surface is mitigated by the following evidence chain:
Ingestion points: The agent reads repository files, call sites, and build logs as described in SKILL.md and references/workflow.md.
Boundary markers: The shared/base/untrusted-content-policy.md (BF-UNTRUSTED-1) provides a strong boundary, instructing the agent to treat repository content as inert data and explicitly ignore embedded prompt-injection directives.
Capability inventory: The skill utilizes tools for searching symbols, renaming variables, and executing test suites.
Sanitization: The BF-SECURITY-1 and BF-EVIDENCE-1 policies mandate redaction of secrets and cite-based evidence for all claims, preventing the accidental execution or propagation of malicious content found in the code.
[COMMAND_EXECUTION]: The skill facilitates the execution of transformation and verification tools. Security is enforced by shared/base/command-execution-policy.md (BF-COMMAND-1), which limits execution to independently necessary and safe commands, prohibiting destructive operations or privilege changes without user consent.
[DATA_EXFILTRATION]: Data safety is maintained through the shared/base/security-and-redaction-policy.md (BF-SECURITY-1), which ensures that secrets are never reproduced in outputs, artifacts, or handoffs, and that existing authorization safeguards are not weakened during refactoring.

refactoring-code