The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses shell commands via git and gh (GitHub CLI) to manage the local repository located at ~/.turbo/repo/. These operations include checking diffs, staging files, creating branches, committing changes, and managing remotes.
[DATA_EXFILTRATION]: The skill is designed to send code changes and metadata to the GitHub repository tobihagemann/turbo. While this involves network transmission of local data, it is the primary intended function. To mitigate the risk of accidental data leakage, the skill implements a 'Privacy Filter' that explicitly instructs the agent to strip sensitive information such as API keys, project names, and credentials before generating descriptions. Additionally, it requires explicit user approval via AskUserQuestion before any data is sent.
[EXTERNAL_DOWNLOADS]: Fetches updates and synchronizes with the upstream repository using git pull during the contribution workflow.
[PROMPT_INJECTION]: The skill processes external files (skill source code and conventions) from the local repository, which presents an indirect prompt injection surface. This risk is managed through the use of human-in-the-loop checkpoints (AskUserQuestion) and a sanitization process ('Privacy Filter') that reviews all generated content before it is committed or pushed.
[SAFE_PRACTICE]: The skill demonstrates security best practices by including a dedicated privacy review step and ensuring the user remains in control of the contribution process.

contribute-turbo