The Agent Skills Directory

[SAFE]: The skill follows security best practices by explicitly instructing the agent to never copy secrets, tokens, or personally identifiable information (PII) into records, issues, or reports, requiring redacted references instead.
[SAFE]: A hard approval gate is implemented, preventing any external actions (such as creating GitHub issues or executing specs) from occurring without explicit user confirmation in Portuguese (pt-BR).
[SAFE]: The repository discovery script scripts/collect-sources.sh is strictly read-only, using standard git and gh commands to inventory local project artifacts without modifying the environment or exfiltrating data.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted external data from GitHub issues, pull requests, and documentation. It mitigates this risk by explicitly defining these sources as data rather than instructions and providing boundary guidance to follow only approved project rules.
[SAFE]: The skill delegates complex operations to trusted sibling skills (write-specs, create-issues, orchestrator) within the same vendor ecosystem, maintaining a clear separation of concerns and capability limits.

gap-analysis