The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill's Python and Bash scripts perform network requests to official registries.
scripts/check-action-pins.py queries the GitHub API (api.github.com) to verify that SHA-pinned actions in the publish workflow match expected version tags.
scripts/publish-preflight.sh queries the PyPI API (pypi.org) to check for existing package versions and identify first-publish scenarios.
[COMMAND_EXECUTION]: The skill interacts with the local system and repository through established CLI tools.
It utilizes git to verify tags and repository state.
It invokes Python packaging and audit tools including uv, twine, and pip-audit for artifact creation, metadata validation, and vulnerability scanning.
It uses the GitHub CLI (gh) to retrieve workflow run logs for diagnostic purposes.
[SAFE]: The skill is designed to improve the security posture of the software supply chain.
It enforces SHA-pinning for GitHub Actions to prevent tag-hijacking attacks.
It promotes the transition from long-lived API tokens to OIDC-based Trusted Publishing.
It includes a pre-flight validation script to catch common errors before a release is finalized and automates best practices via hardened workflow templates.

pypi-ops