The Agent Skills Directory

[PROMPT_INJECTION]: The skill includes an instruction for the agent to output a specific phrase ("🏠 I read shunk031-herdr-chezmoi-apply") upon reading the file. While benign in intent, it represents a minor instruction to override the agent's natural response behavior.
[CREDENTIALS_UNSAFE]: The skill instructs the agent to access and use GitHub authentication tokens via GITHUB_TOKEN="$(gh auth token)" for chezmoi operations. It also tasks the agent with redacting secrets from git diffs, which requires the agent to handle and interpret sensitive data during the change summarization process.
[COMMAND_EXECUTION]: The skill performs shell command execution across local and remote targets using SSH (e.g., ssh <target> 'git ...'). It automates complex workflows involving git, chezmoi, and gh, and includes the use of dynamic environment variables to override Git configurations.
[EXTERNAL_DOWNLOADS]: The skill references mise install for tool acquisition and skills update for cloning repositories, which involve downloading external assets and code at runtime.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external sources such as Git diffs and repository status outputs, which could potentially contain malicious instructions embedded by an attacker in tracked files or commit metadata.
Ingestion points: Tool outputs from git status, git diff, and chezmoi status as described in SKILL.md.
Boundary markers: The skill lacks explicit delimiters to isolate external tool output from the agent's instructional context.
Capability inventory: Remote SSH execution, authentication token access, and system configuration modification via chezmoi.
Sanitization: Relies on the agent's ability to manually redact secret values before including them in reports.

shunk031-herdr-chezmoi-apply