The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on local command-line tools, specifically ripgrep (rg) and git, to search through the project's working tree and commit history. These commands are used for auditing purposes and are restricted to local file access.
[PERSISTENCE]: The skill provides instructions to install a local shell script (scripts/commit-msg) as a Git commit-msg hook. This ensures the auditing logic runs automatically when new commits are created. This mechanism is a standard practice for development linters and is explicitly documented within the skill's enforcement section.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it ingests and processes untrusted text from project files and commit messages.
Ingestion points: Untrusted data enters the agent context via ripgrep and git log/show output (SKILL.md).
Boundary markers: The skill includes a 'Security Model' section that explicitly instructs the agent to treat scanned content as data only, use markdown quoting/tables for evidence, and never follow directives found within the analyzed text.
Capability inventory: The skill can execute local search commands, write to project files in 'Fix mode', and install git hooks.
Sanitization: The instructions mandate quoting snippets in tables and suggest post-filtering regex output to avoid unintended matches against the skill's own instructions.
[DYNAMIC_EXECUTION]: The verification script scripts/test_patterns.py utilizes the subprocess module to execute the scripts/commit-msg shell script during unit testing to ensure regex patterns are working correctly across different environments.

negafix