The Agent Skills Directory

[SAFE]: The skill follows security best practices by recommending the use of GitHub Actions OIDC (OpenID Connect) for tokenless authentication and enabling npm provenance for verifiable build-to-source links.\n- [SAFE]: Use of external tools is restricted to well-known and reputable packages such as @arethetypeswrong/cli for type validation and tsup for bundling.\n- [SAFE]: No hardcoded credentials were found; the skill correctly instructs users to utilize environment secrets (e.g., ${{ secrets.NPM_TOKEN }}) for registry authentication.\n- [SAFE]: The mandatory workflow involves internal agent calls that align with the developer's ecosystem and legitimate documentation query tools.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests configuration data from local project files (e.g., package.json) as documented in the ingestion points. While no specific boundary markers are defined in the instructions to separate data from prompts, the capability inventory is limited to standard package management tools (npm, npx, jsr). Sanitization is handled by the underlying execution environment of these standard tools, making the surface acceptable for its intended purpose.

ts-packaging