The Agent Skills Directory

[SAFE]: The skill implements a PreToolUse hook in scripts/protect-token.sh specifically designed to prevent the accidental exposure of GITHUB_TOKEN and GITLAB_TOKEN. This script proactively blocks shell commands like echo, printenv, or curl -v that would reveal the secret values, while permitting safe operations like checking the token's length.
[SAFE]: The instructions in SKILL.md and the reference files in references/ emphasize "Token safety" and provide clear guidance to the agent on how to handle secrets securely, reinforcing the technical controls in the hook.
[SAFE]: The skill uses well-known, official APIs (GitHub and GitLab) for its operations and explicitly requires user opt-in before performing any external network actions (posting comments).
[SAFE]: The workflow encourages best practices such as verifying security, performance, and adherence to project standards without introducing any dangerous patterns like arbitrary remote code execution or data exfiltration.

code-review