The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of the subprocess module in checkpoint_sync.py and repo_sync_check.py to interact with the local system. These calls are used to execute Git commands (status, rev-parse, commit, push, fetch), macOS notification utilities (osascript), and audio tools (say, afplay). The commands are executed using argument lists, which prevents shell injection, and are necessary for the skill's primary function of repository management.
[EXTERNAL_DOWNLOADS]: The skill performs network operations via Git commands (git fetch, git push). These operations are protected by a 'remote guard' mechanism in checkpoint_sync.py that validates the destination remote against a user-configured list of allowed prefixes, ensuring data is only transmitted to authorized namespaces.
[SAFE]: The skill implements several security and privacy best practices, including a confidentiality rule that prevents sensitive repository or client names from being output via public-facing channels like audio or desktop notifications. It also uses a lifecycle lock to serialize state mutations and requires session authority checks to prevent unauthorized recovery of repository manifests.

synthesis-repo-guard