The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes standard system utilities including git, gh, and python via the node:child_process module. These executions are core to the skill's functionality for managing session logs and reconciling state with remote repositories.
[EXTERNAL_DOWNLOADS]: The skill interacts with remote git repositories (defined by environment variables like SESSION_MEMORY_URL) and the GitHub API (via gh CLI) to synchronize session data and verify ticket status. These operations are consistent with the skill's primary purpose.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data such as git history, ticket comments, and log files to generate HTML and Markdown views. It mitigates potential injection risks by implementing strict event validation and using HTML escaping (via the esc() function) when rendering content to the ledger page.
[SAFE]: The skill includes a dedicated security feature (check-push-blocklist) designed to scan outgoing content for sensitive environment variables and secrets before they are pushed to a remote repository. Additionally, the skill operates without any third-party package dependencies, significantly reducing the supply chain attack surface.

thread-ledger