The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes Git commands through execFileSync in ledger.mjs and heartbeat.mjs. This is the primary function of the skill to manage a session-memory store (a Git repository) and is restricted to the configured repository roots.
[EXTERNAL_DOWNLOADS]: The skill uses gh (GitHub CLI) in ledger.mjs to reconcile thread status against the forge. This is an expected feature for developers using the tool and requires local authentication.
[REMOTE_CODE_EXECUTION]: The heartbeat.mjs script acts as a Stop hook, executing checks against the local environment (Git status, file modifications). While it runs automated checks, it does not download or execute arbitrary remote scripts.
[DATA_EXFILTRATION]: scan.mjs implements a safety scanner designed to prevent data exfiltration by blocking the push of content containing sensitive environment variables like SESSION_MEMORY_URL or user-defined blocklist terms.

thread-ledger