The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references and fetches installation scripts for the actionlint and act validation tools from their official GitHub repositories. These are well-known development tools used for the skill's stated purpose of workflow validation.
[REMOTE_CODE_EXECUTION]: Documentation and examples include shell commands to download and execute installers for actionlint, act, and Anchore's grype. These operations target official domains and repositories of established open-source projects and security vendors, complying with the trusted source safety guidelines.
[INDIRECT_PROMPT_INJECTION]: The skill explicitly identifies and provides mitigations for indirect prompt injection surfaces in GitHub Actions. It mandates the use of environment variable indirection (env:) instead of direct interpolation (${{ }}) for untrusted event data, which is a critical security standard to prevent shell injection attacks.
[COMMAND_EXECUTION]: The skill generates GitHub Actions workflows that execute shell commands. It includes rigorous validation checks (e.g., [INJECTION]) and explicit instructions to ensure these commands are executed safely within the runner environment.

github-actions