The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted repository files (source code, documentation, and configuration) to generate wiki pages, creating a surface where malicious instructions embedded in the project files could influence the agent during ingestion or subsequent queries.
Ingestion points: Git-tracked repository files, including README.md, docs/, and package configurations, as specified in the 'Ingest' section of SKILL.md.
Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are used when processing the content of ingested files.
Capability inventory: The skill executes shell commands (git rev-parse, git diff, git ls-files) and a local Node.js script (scripts/export-wiki-bundle.mjs) which has file system read and write access.
Sanitization: The export script includes escapeHtml and cleanMarkdown functions, but these are focused on output formatting and stripping Obsidian-specific syntax rather than sanitizing against prompt injection.
[DATA_EXFILTRATION]: The skill's 'Ingest Priorities' explicitly list 'secrets' as a target for documentation. While this is limited to git-tracked files, it increases the risk of sensitive information being aggregated into a wiki and subsequently exported or shared.
[COMMAND_EXECUTION]: The skill relies on executing shell commands (git) and a local Node.js script (node skills/git-wiki/scripts/export-wiki-bundle.mjs) to perform its core functions. It uses user-provided directory names as wiki roots, which are passed to these commands.
[BEST_PRACTICE_VIOLATION]: The skill instructions explicitly state 'Do not ask the user before ingesting' and 'Ingest is automatic. Do not ask the user for confirmation', which reduces user oversight of the agent's file system operations.

git-wiki