The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from untrusted sources (external Git repositories).
- Ingestion points: The skill audits all subdirectories within ~/code/ and executes commands to read Git metadata, including git remote get-url origin, git log -1, and git worktree list (SKILL.md, Phase 1).
- Boundary markers: There are no explicit boundary markers or instructions to the agent to ignore potentially malicious content embedded in Git remote URLs, branch names, or commit messages.
- Capability inventory: The skill has the capability to execute shell commands for auditing (git) and file system manipulation (rename, move, archive, delete) (SKILL.md, Phase 4).
- Sanitization: The instructions do not specify any sanitization or escaping of the metadata retrieved from repositories before it is processed or displayed in report tables.
[COMMAND_EXECUTION]: The skill performs active file system operations and shell command execution.
- Evidence: The skill executes git commands to collect inventory and proposes destructive actions such as delete and archive for local directories (SKILL.md, Phase 1 & 3).
- Control: The skill includes a manual confirmation step ("ask for confirmation before executing") which significantly mitigates the risk of automated unauthorized file manipulation (SKILL.md, Phase 4).

code-cleanup