The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/verify-reproducible-build.sh utilizes the eval command to execute build instructions provided via command-line arguments. If an agent or user provides an untrusted string to this script, it could lead to arbitrary code execution.
[COMMAND_EXECUTION]: Reference documentation in references/github.md includes commands for freeing disk space using sudo rm -rf on system-level directories. While standard for reclaiming space in GitHub Actions runners, these commands are destructive and unsafe for general use on local machines or unauthorized environments.
[EXTERNAL_DOWNLOADS]: The script scripts/verify-badge-links.sh parses the project's README.md for URLs and performs curl requests to verify them. This behavior introduces a server-side request forgery (SSRF) risk if the README content is controlled by an untrusted party.
[EXTERNAL_DOWNLOADS]: Documentation in references/quick-start-guide.md provides an example of the 'curl pipe bash' pattern (curl -sSL https://get.example.com | sh) for software installation. This is a high-risk pattern as it executes remote code without prior verification.
[SAFE]: The skill incorporates numerous integrations with trusted industry platforms, such as the OpenSSF Scorecard (api.securityscorecards.dev), Codecov, and Sigstore. These references are part of the skill's core defensive purpose and originate from well-known technology organizations.

enterprise-readiness