The Agent Skills Directory

[SAFE]: The skill's scripts are designed for local static analysis of specification IDs within a repository. No network activity or unauthorized file access was identified. The provided templates and documentation follow best practices for requirement tracing.\n- [COMMAND_EXECUTION]: The skill uses spawnSync to execute git log for checking commit history and to run internal self-tests. Commands are constructed using argument arrays to prevent shell injection. These operations are restricted to the local repository context and the skill's own internal logic.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes repository content including markdown, source code, and commit messages. While this presents an ingestion surface for untrusted data, the processing is limited to regex-based ID extraction and reporting. There are no mechanisms for these inputs to influence agent behavior or reach dangerous execution sinks, as the data is used strictly for traceability reporting.

spec-traceability