The Agent Skills Directory

[SAFE]: The skill operates entirely locally within the repository's filesystem. There are no network requests, external data fetches, or exfiltration patterns detected in the source code.
[SAFE]: The project follows a dependency-free architecture, relying solely on Node.js standard libraries (node:fs, node:path, node:child_process). This effectively eliminates the risk of supply chain attacks or malicious third-party dependencies.
[SAFE]: Command execution is handled via execFileSync targeting the git binary. Arguments are passed as an array rather than a single string, which prevents shell injection vulnerabilities. The tool is read-only regarding the Git index; it does not perform commits, pushes, or deployments.
[SAFE]: The skill includes a dedicated security utility in src/doctor.mjs that scans for credential-shaped patterns (e.g., Google API keys, GitHub tokens, Slack tokens) and private keys. This is a defensive feature designed to warn the user and agent before sensitive information is committed to the project history.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes metadata and markdown content from the project repository (tasks.md, PROJECT.md, and history logs). This constitutes a potential indirect prompt injection surface where a malicious file could attempt to influence agent behavior. However, the skill implements strong defensive guardrails: SKILL.md explicitly instructs agents to verify history against actual code and enforces specific 'validation gates' that must pass before work is considered complete. Slugs and filenames are sanitized through a slugify function to prevent directory traversal or command injection.

relay