The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill's templates and documentation reference numerous third-party GitHub Actions and security tools. These include well-known services such as TruffleHog, Gitleaks, Semgrep, Trivy, Grype, Snyk, and Codecov. While these involve external code execution within pipelines, they are standard DevOps tools used for security enforcement and quality assurance.
[COMMAND_EXECUTION]: The skill provides a local Python utility, scripts/pipeline_analyzer.py, designed to perform static analysis on GitHub Actions and GitLab CI configuration files. It also provides a variety of shell commands using the gh and gl CLIs to manage and troubleshoot pipelines. These are legitimate administrative tools for the CI/CD domain.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data in the form of CI/CD configuration files (YAML) provided by the user for analysis. While this creates a surface for potential injection, the analysis script uses yaml.safe_load() to mitigate risks associated with untrusted YAML parsing.
Ingestion points: User-provided CI/CD configuration files are read by scripts/pipeline_analyzer.py for performance and security analysis.
Boundary markers: None explicitly present in the data ingestion flow.
Capability inventory: The skill can read local files via the analyzer script and execute shell commands for pipeline management.
Sanitization: The Python script correctly uses yaml.safe_load() to prevent unsafe object instantiation during parsing.

ci-cd