The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the use of well-known and trusted development tools such as arethetypeswrong, tsup, and the jsr CLI through standard package managers (npm/npx). These are industry-standard tools for TypeScript development and do not represent a security risk.
[COMMAND_EXECUTION]: The provided workflows and templates contain shell commands for building and publishing packages (npm publish, npx jsr publish, tsup). These are standard operations for the skill's primary purpose and are intended to be executed within the user's controlled development or CI/CD environment.
[CREDENTIALS_UNSAFE]: The skill follows security best practices for secret management. It recommends using GitHub Actions secrets (${{ secrets.NPM_TOKEN }}) for authentication and advocates for tokenless OIDC authentication (id-token: write) to generate provenance, which reduces the risk of credential exposure.
[INDIRECT_PROMPT_INJECTION]: The fuse-ai-pilot:explore-codebase workflow step involves reading local configuration files like package.json. This is a standard project inspection task for the intended use case, and the data is limited to the user's own project files, minimizing the risk of adversarial injection.
[PERSISTENCE]: No persistence mechanisms, such as modifications to shell profiles or cron jobs, were identified in the provided templates or instructions.
[OBFUSCATION]: The skill uses clear, human-readable markdown and standard JSON/YAML structures. No attempts to hide or encode malicious commands were found.

ts-packaging