The Agent Skills Directory

[COMMAND_EXECUTION]: The skill implements extensive environment sanitization using /usr/bin/env -u prefixes for all shell executions. This prevents inherited environment variables, such as BASH_ENV, GIT_CONFIG_PARAMETERS, or transport overrides like GIT_SSH_COMMAND, from being used to hijack the git process or bypass security hooks.
[COMMAND_EXECUTION]: The skill constructs git push commands using an explicit refspec format ${PLAN_HEAD_SHA}:refs/heads/${BRANCH} and the -- option separator. This ensures that branch names or SHAs cannot be interpreted as command-line flags and that only the specific commit approved by the user is pushed.
[DATA_EXPOSURE]: The skill automatically redacts sensitive information, such as authentication tokens or passwords, from remote URLs before they are displayed in user prompts or logs. It uses a custom redaction logic to mask userinfo, query parameters, and fragments.
[DATA_EXPOSURE]: To prevent destination hijacking, the skill generates SHA-256 digests of raw remote URLs. These digests are used to cryptographically bind the user's approval to a specific destination, ensuring the push is aborted if the repository configuration changes between the approval and execution phases.
[INDIRECT_PROMPT_INJECTION]: The skill identifies the risk of processing untrusted data from the git environment (branch names and URLs). It mitigates this via a multi-phase validation workflow (Phase 0-2) where the final execution environment is re-verified against the state approved by the user in the AskUserQuestion gate.
[REMOTE_CODE_EXECUTION]: The skill explicitly forbids the use of remote-sourced variables or configurations that could lead to unverified code execution, such as custom receive-pack programs or transport-layer wrappers.

push-ci