The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill explicitly searches for sensitive information as part of its security audit function. It scans for credential patterns such as OpenAI keys (sk-), GitHub tokens (ghp_), AWS access keys (AKIA), and private key headers (-----BEGIN). It also identifies sensitive file types like .env and certificate files (.pem, .key, .p12).
[COMMAND_EXECUTION]: The skill utilizes shell commands to interact with the git repository and analyze its state.
Evidence: Executes git ls-files, git log, and git branch commands within SKILL.md and references/git-hygiene.md to collect audit data.
[PROMPT_INJECTION]: The skill processes untrusted data from external git repositories, which presents an indirect prompt injection surface.
Ingestion points: Data is ingested from git commit messages, branch names, and the content of tracked files during secret scanning.
Boundary markers: No specific boundary markers or 'ignore' instructions are used to wrap the repository data.
Capability inventory: The skill has access to shell execution tools (git, grep) to perform its audit tasks.
Sanitization: The skill does not perform sanitization or validation of the repository data before it is processed or included in the final report.

orbitant-git-hygiene