The Agent Skills Directory

Git Command Execution: The skill automates several Git operations including worktree, fetch, rebase, and commit. While automated command execution warrants review, these operations are restricted to a local environment, require explicit user invocation, and are prohibited from performing mutations like push or PR creation on remote repositories.
External Data Processing (Takeover Mode): The skill can ingest metadata and diffs from external pull requests to facilitate code takeovers. This introduces a surface for indirect prompt injection if the external PR content contains malicious instructions. The skill addresses this by enforcing manual review of the diff before committing and requiring the agent to independently verify contributor identities rather than blindly trusting PR metadata.
Local Script Invocation: The workflow executes a bundled Python script (validate_handoff.py) to verify Git invariants. This script uses subprocess.run to call Git binaries. The implementation uses capture_output=True and handles return codes, which is a standard pattern for repository management tools and does not introduce unusual risks beyond the intended local validation logic.
Data Exfiltration Boundaries: The skill instructions include explicit 'non-negotiable boundaries' that forbid the agent from performing network-mutating operations like pushing code or opening PRs, limiting the scope of activity to the user's local machine.

implementation-kickoff