The Agent Skills Directory

[DATA_EXFILTRATION]: The skill implements strict path boundary enforcement (NFR-8) using fs.realpathSync to resolve the --context path and all Evidence entries. It validates that all accessed files are within the repository root or a designated temporary directory, effectively preventing unauthorized access to sensitive system files.
[DATA_EXFILTRATION]: All outbound responses are processed through scripts/security-redact.js (NFR-7), which is designed to identify and mask or abort on the detection of potential secrets or credentials in the generated output.
[COMMAND_EXECUTION]: Shell command execution is limited to specific tools (git, node) and is primarily used for metadata verification and security processing. The skill avoids shell interpolation of user-supplied arguments.
[PROMPT_INJECTION]: The skill uses a deterministic decision algorithm for intent classification (Phase 2) to categorize user questions before involving an LLM. The Codex prompt template includes explicit instructions for independent research and strictly bounds its search space to an Evidence allowlist defined by the recap document, mitigating the risk of instructions from the document or user question overriding the agent's behavior.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data (recap documents) and interpolates it into LLM prompts.
Ingestion points: Reads the file specified by the --context flag and files indexed in the recap's §7 Evidence section.
Boundary markers: Uses structured prompts in references/qa-prompt.md with explicit headers like ## Recap Context and ## Question.
Capability inventory: Employs Read, Grep, Glob, Bash, and Codex tools.
Sanitization: All output is sanitized via scripts/security-redact.js before being displayed to the user.

recap-ask