The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill generates workflows that reference multiple official and well-known GitHub Actions (e.g., actions/checkout, actions/setup-node, docker/login-action, aws-actions/configure-aws-credentials). All references in the provided examples and templates are pinned to specific commit SHAs, which is the recommended security practice for mitigating supply chain risks.
[INDIRECT_PROMPT_INJECTION]: The skill provides templates and examples for automating responses to external events, such as PR titles and issue comments (examples/triggers/chatops-commands.yml). These represent ingestion points for untrusted data; however, the skill explicitly includes documentation and code examples that demonstrate how to handle this data safely by using environment variables (the env context) to prevent command injection vulnerabilities.
[COMMAND_EXECUTION]: The skill includes a local bash script (scripts/test_generator.sh) designed for regression testing and validation of YAML templates. The script performs benign file system operations such as discovering files and checking for string patterns (e.g., verifying SHA pinning). It does not perform network operations, access sensitive user data, or modify system configurations.
[CREDENTIALS_UNSAFE]: No hardcoded secrets were found. The skill templates and examples correctly use GitHub Action secrets (e.g., ${{ secrets.GITHUB_TOKEN }}) and OIDC-based authentication for cloud providers, following the principle of least privilege.

github-actions-generator