The Agent Skills Directory

[SAFE]: The skill implements a read-only analysis workflow designed to audit git branches for merge readiness. It uses standard command-line tools like git (via Bash) and grep to extract metrics and scan for artifacts.\n- [DATA_EXPOSURE]: The skill includes explicit instructions to scan for hardcoded secrets in the diff. It includes a safety guardrail to never include actual secret values in the output, preventing accidental exposure of credentials in logs or responses. It writes analysis snapshots to a local directory (.history/pr-retros/), which is a standard practice for development tools.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data such as commit messages and code diffs. While this constitutes an attack surface for indirect prompt injection, the skill is designed for metric computation and artifact detection, and there is no evidence of the skill interpreting or executing instructions embedded in the processed data.\n- [COMMAND_EXECUTION]: The skill uses the Bash tool to gather git data. This is appropriate and necessary for the intended purpose of branch analysis. The execution is scoped to gathering statistics and diffs rather than executing code from the repository.

pr-retro