The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to perform file system operations, specifically deleting the .git/index.lock file using rm. While this is a common recovery step for Git, it represents a destructive capability.
[COMMAND_EXECUTION]: The skill utilizes a non-standard command-line utility kimaki to read session metadata (kimaki session read).
[INDIRECT_PROMPT_INJECTION]: The skill processes Git commit messages, diffs, and logs, which are external data sources that could contain malicious instructions.
Ingestion points: Commands such as git log, git show, and git diff ingest content from the repository history into the agent's context.
Boundary markers: The instructions do not define boundary markers or delimiters to separate commit data from the agent's internal logic.
Capability inventory: The agent has capabilities to delete files (rm) and manipulate repository state (git rebase).
Sanitization: There is no evidence of sanitization or filtering of the Git history content before it is read by the agent.

git-history