The Agent Skills Directory

Standard Command Execution: The skill utilizes a local Python script resolve_security_md.py to identify and resolve security policy files within the repository. This is part of the skill's intended functionality to inventory and manage policy guidance.
External Source References: The instructions reference a guidance file located at ../../references/security-guidance.md. This path indicates it is part of the broader, local plugin environment rather than an untrusted remote source.
Data Handling and Boundaries: The skill incorporates protective measures such as a 1 MiB file size limit for policy processing and explicit instructions to escape control characters for safe display. It also mandates that policy files should not be treated as a source of authority for commands or edits, which is a positive security practice.
Repository Interaction: While the skill involves reading and drafting file changes, it requires explicit human approval before any file writes and waits for user requests before performing version control actions like staging or committing.

define-security-policy