The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The scripts publish-preflight.sh and check-action-pins.py perform network requests to pypi.org and api.github.com respectively. These operations are used to verify package availability and resolve commit SHAs for auditing GitHub Action versions. These are well-known services and the operations are essential for the skill's security-auditing functionality.
[INDIRECT_PROMPT_INJECTION]: The diagnose-publish.sh script presents a data ingestion surface by processing GitHub Actions run logs.
Ingestion points: Reads log data from stdin or via the gh run view command in diagnose-publish.sh.
Boundary markers: Absent; the script operates directly on raw log strings.
Capability inventory: Utilizes shell-based text classification tools including grep, sed, and awk within bash scripts.
Sanitization: Content is classified using regular expression matching to identify known failure patterns but is not executed or used to generate dynamic commands.
[COMMAND_EXECUTION]: The skill executes local development and packaging tools such as uv, twine, pip-audit, and git. These executions are standard for the skill's intended purpose of managing and verifying the Python package release process.

pypi-ops