The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses standard Git commands (fetch, status, worktree, branch) to verify the state of the local repository. These operations are restricted to the local environment and are necessary for the skill's purpose of release auditing.
[REMOTE_CODE_EXECUTION]: The skill executes a local Python script scripts/check_release_packet.py. This script was audited and found to be safe; it performs file parsing (CSV, JSON, YAML) and regex-based validation without network access or unsafe dynamic execution (using yaml.safe_load where applicable).
[DATA_EXFILTRATION]: No unauthorized data exfiltration patterns were detected. The skill specifically includes a privacy check (LOCAL_PATH_RE) in its validation script to identify and prevent the inclusion of local absolute paths in academic release packets.
[PROMPT_INJECTION]: The instructions contain clear boundaries between agent-generated advisory content and human-verified final evidence, explicitly instructing the agent not to promote its own review output to a final state.

release-governance