The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill configuration downloads various tools and dependencies required for the development environment.
Fetches the uv installer from astral.sh, which is the official domain for the Astral organization.
Configures GitHub Actions that utilize official and well-known actions such as actions/checkout, astral-sh/setup-uv, and Swatinem/rust-cache.
Manages dependencies via official registries including NPM, PyPI, and Crates.io.
[REMOTE_CODE_EXECUTION]: The skill includes a bootstrap command for the uv package manager using a piped execution pattern.
The command curl -LsSf https://astral.sh/uv/install.sh | sh is the standard and official installation method provided by the vendor. Given the trusted nature of the source, this is acceptable for the skill's purpose.
[COMMAND_EXECUTION]: The skill generates and configures numerous Git hooks and CI/CD scripts that execute a wide range of shell commands.
These commands are restricted to standard development operations such as pnpm, uv, cargo, ruff, eslint, and vitest.
Utility commands like grep, sed, git, and find are used for localized file analysis, specifically for quality checks and secret detection.
The execution logic is transparent and aligned with the primary objective of establishing a secure and high-quality repository infrastructure.
[INDIRECT_PROMPT_INJECTION]: The skill provides templates for CI scripts that ingest data from external sources.
The post-deploy verification workflow in references/ci-pipeline.md processes the deploy_url from the GitHub Action's client_payload.
Although this represents a surface for untrusted data ingestion, the risk is localized to the CI environment and follows standard practices for automated deployment testing.

repo-quality-rails-setup