The Agent Skills Directory

[COMMAND_EXECUTION] (LOW): The skill executes git commands through subprocess.run. It correctly uses argument lists to prevent shell injection, but it retrieves the commit ID from metadata files which could be manipulated.
[PROMPT_INJECTION] (LOW): An indirect prompt injection surface is present. 1. Ingestion points: The skill reads metadata.json, feature_list.json, and various state files in the .claude/ directory. 2. Boundary markers: None. 3. Capability inventory: Supports file deletion via shutil.rmtree, restoration via shutil.copytree, and git state manipulation via git reset --hard. 4. Sanitization: No validation or sanitization of checkpoint_id or git_commit strings retrieved from metadata, which could lead to path traversal or unintended state changes if the source files are malicious.

ac-checkpoint-manager