The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands using git and bash to analyze repository state and perform commits. Security is maintained through environment stripping using a literal env -u prefix, establishing privileged mode with /bin/bash -p, and mandatory user approval via AskUserQuestion before any repository modifications are executed.- [CREDENTIALS_UNSAFE]: The skill reads local git identity configuration (such as user.name and user.email) and signing settings to provide diagnostics. This data is used to ensure commits are correctly attributed and signed according to local policy, with output escaped to prevent terminal injection.- [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from git history and file diffs to generate commit messages.
Ingestion points: Git commit history and file diffs read via smart-commit-inspect.sh in the style and diff subcommands.
Boundary markers: The agent follows specific instructions to infer style and generate messages matching project conventions.
Capability inventory: The skill can execute repository writes via git commit within smart-commit-execute.sh.
Sanitization: A mandatory AI trailer sanitization pass strips forbidden patterns from generated messages, and runtime validation is performed by smart-commit-execute.sh using a canonical guard script.

smart-commit