The Agent Skills Directory

[COMMAND_EXECUTION]: The bundled script uses node:child_process (execFileSync) to execute git commands such as git log and git for-each-ref. These commands are used to inspect the local repository state (e.g., checking for unmerged commits or last commit dates) to determine if an inbox entry is a candidate for archiving. The parameters are derived from the Paperclip API data and the skill's own classification logic.
[DATA_EXPOSURE]: The skill utilizes the PAPERCLIP_API_KEY and PAPERCLIP_API_URL environment variables to interact with the vendor's API. It decodes the JWT provided in the API key to identify the target user (responsible_user_id). This is standard procedure for authenticated Paperclip skills.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the Paperclip API (issue titles and identifiers) and renders them into markdown reports and interactive checkboxes. It mitigates potential markdown injection by implementing a markdownEscape function that sanitizes pipe characters and newlines, and by truncating display strings.

garden-inbox