The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes deployment rules and script execution paths from project-specific files like rules/git-workflow-project.md. This represents an attack surface where a malicious project could attempt to influence the agent's behavior.
Evidence: The skill reads and parses the ## Deploy Workflow section of local markdown files to determine its next actions.
Sanitization: The skill mitigates this by requiring explicit human approval for every step via AskUserQuestion, pinning OIDs/hashes, and strictly validating the format of the declaration files using a custom parser.
[DYNAMIC_EXECUTION]: The skill uses a 'pinning' technique in Phase 0 where it copies its helper script (deploy-flow.sh) to a temporary file before execution. This is a security design pattern intended to prevent 'branch-switch' attacks, where a project could swap the script for a malicious version when the agent switches branches during a merge.
Evidence: DF=$(mktemp "${TMPDIR:-/tmp}/deploy-flow.XXXXXX") && cat -- "$SRC" > "$DF" in Phase 0 of SKILL.md.
Execution Method: The skill uses /bin/bash -p to execute the temporary script, which ignores potentially malicious environment variables and user configuration files.
[COMMAND_EXECUTION]: The skill executes git operations and project-defined scripts relative to the repository root.
Capability Inventory: The skill can perform git switch, git merge, and execute arbitrary repository-tracked scripts via the run subcommand.
Security Controls: Every script execution requires Run Steps: execute to be explicitly enabled in the project rules, and the execution is gated by hash-verification (--expect-blob) and a clean-worktree requirement to ensure the user approves exactly what is run.

deploy-flow