The Agent Skills Directory

[SAFE]: The skill encourages the principle of least privilege by instructing the agent to default workflow permissions to empty and grant only minimal necessary permissions per job.
[SAFE]: It promotes supply chain security by mandating the pinning of external actions and reusable workflows to full commit SHAs rather than mutable tags.
[SAFE]: The instructions include specific mitigations for common CI/CD vulnerabilities, such as passing untrusted expressions through environment variables and validating/quoting them before use to prevent command injection.
[SAFE]: The skill provides structured guidance for handling privileged operations and fork-originated workflows, emphasizing the need for approval boundaries and validation of cross-run data.

ci-maintenance