The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a bash script scripts/log.sh to append rows to a TSV file. The script uses printf and tr for sanitization, and includes a protective mechanism to prefix characters like =, +, -, and @ with a single quote. This is a security feature designed to prevent CSV/spreadsheet formula injection (CWE-1236) when a human reviewer opens the resulting log in a tool like Excel or Google Sheets.
[INDIRECT_PROMPT_INJECTION]: The skill processes 'evidence' which could originate from untrusted sources (PR titles, filenames, etc.). However, it implements explicit sanitization in scripts/log.sh to strip control characters and escape formula-triggering prefixes, mitigating the risk of downstream exploitation.
[PRIVILEGE_ESCALATION]: The skill performs standard filesystem operations (creating directories and files via mkdir -p and printf >>) within the user's workspace. It does not attempt to gain elevated privileges or access sensitive system paths.
[METADATA_POISONING]: The skill name and description accurately reflect its functionality as a decision-logging utility. No deceptive or malicious instructions were found in the metadata fields.

show-me-your-work