The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes various local commands to audit the repository state.
SKILL.md and scripts/verify-git-workflow.sh use standard Git commands (git branch, git log, git diff, git rev-parse) and common utilities (grep, sed, awk) to verify naming conventions and file existence.
checkpoints.yaml specifies automated checks using gh_api for GitHub repository protection settings and LLM-based reviews that process the output of git log.
[EXTERNAL_DOWNLOADS]: The skill references several external development tools and repositories.
references/code-quality-tools.md provides instructions for downloading and installing difftastic from its official GitHub releases and shfmt via the mvdan.cc Go package registry.
SKILL.md references the author's own repository (github.com/netresearch/git-workflow-skill) for contributions.
These downloads target well-known open-source tools and the vendor's own infrastructure, posing no inherent security risk in this context.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the repository's commit history.
Ingestion points: Commit messages and branch names are read into the agent's context via git log and git branch (referenced in checkpoints.yaml and verify-git-workflow.sh).
Boundary markers: The LLM review prompts in checkpoints.yaml lack explicit boundary markers or instructions to ignore embedded commands within the log output.
Capability inventory: The skill's environment has access to the local filesystem and the ability to execute shell scripts and Git commands.
Sanitization: There is no evidence of filtering or escaping commit messages before they are processed by the LLM reviews.
Although this presents a surface for indirect prompt injection if a malicious commit message is present, the risk is inherent to the auditing task and considered low severity.

git-workflow