The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes several Python scripts (branch_name.py, commit-change-stats.py, validate-commit-message.py) to interface with the local git binary. These scripts use subprocess.run with list-based arguments (avoiding shell execution) and employ security best practices such as using --end-of-options to prevent command injection via maliciously crafted revision strings.
[INDIRECT_PROMPT_INJECTION]: The skill processes Git diffs and user-provided commit messages which represent an untrusted data surface.
Ingestion points: Raw Git diffs, staged content, and commit message files are read by the scripts.
Boundary markers: The SKILL.md and commit-message.md files define strict structural requirements and behavioral boundaries for the agent.
Capability inventory: The skill has the capability to execute git add and git commit commands locally.
Sanitization: All commit messages are processed through a dedicated validator script (validate-commit-message.py) that enforces a specific schema, and Git arguments are resolved via rev-parse with validation markers.
[SAFE]: No network operations, external data exfiltration, or credential exposures were identified. The skill is explicitly scoped to local Git operations and avoids commands like git push or git remote.

git-commit