The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from repository state and external APIs, creating a potential surface for indirect injection.
Ingestion points: The skill reads output from git status, git branch, git log, git diff, and various GitHub API endpoints (gh api).
Boundary markers: The skill includes explicit instructions to propose all branch names, commit sets, and PR bodies to the user and wait for an explicit "OK" before execution.
Capability inventory: The skill has the capability to execute shell commands via git and gh CLI tools, as well as local project scripts using bun.
Sanitization: Pull request bodies are written to temporary files and passed to the gh CLI using the --body-file flag to mitigate shell escaping and command injection risks.
[DATA_EXFILTRATION]: The skill is configured to append forensic trailers to every commit message, which are then pushed to remote repositories.
Evidence: Instructions in SKILL.md require closing every commit with Worktree: <name|primary> and Session: <label> trailers derived from the agent's identity context.
Impact: This results in the intentional transmission of environment-specific metadata (worktree names and session identifiers) to external git hosts for the purpose of auditing and post-mortem analysis.
[COMMAND_EXECUTION]: The skill performs extensive repository mutations using the git and gh command-line interfaces.
The logic includes protections against dangerous operations, such as refusing to force-push (--force) or rewrite pushed history without explicit, documented user authorization.
[DYNAMIC_EXECUTION]: The skill executes local project-specific scripts to verify policies and provision environments.
Evidence: Use of bun run git:policy verify and bun run worktree:provision to interact with project infrastructure. These are local developer tools within the repository's context.

git-flow-master