The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The file references/develop-pipeline-install-hooks.sh contains a text-based hint instructing users on how to install required components using a remote script (https://raw.githubusercontent.com/Gamaroff/agent-skills/main/scripts/setup-consumer.sh). This resource belongs to the author's own repository and is presented as an instruction to the human operator rather than being executed automatically by the skill.
[COMMAND_EXECUTION]: The skill makes extensive use of system tools such as git, gh (GitHub CLI), and node to automate the development pipeline. These operations are essential for its primary function and include robust error handling and verification steps to ensure consistency between the local environment and the remote tracker state.
[DATA_EXFILTRATION]: While the skill communicates with external APIs (GitHub, Jira, Bitbucket), it includes a robust redaction engine in references/defer-mutation.js and references/handover-render.js. This system scans all data before it is logged or written to checklists, automatically replacing detected secrets (tokens, passwords, keys) with their environment variable names or masking them entirely.
[INDIRECT_PROMPT_INJECTION]: The QA and triage components (e.g., references/test-failure-triage-prompt.md, references/code-review-prompt.md) process external inputs such as test logs and code diffs. The skill mitigates risks by isolating this processing within dedicated Explore subagents that return only structured, sanitized summaries back to the main orchestrator context.
[OBFUSCATION]: The references/handover-render.js module uses Base64 encoding for body payloads inside generated shell scripts. This is a functional implementation used to ensure that complex characters (like backticks or subshell expansions) are preserved correctly during round-tripping and do not break shell quoting, rather than an attempt to conceal malicious intent.
[DYNAMIC_EXECUTION]: The skill employs dynamic execution in two controlled contexts. In references/resolve-platform.sh, eval is used for indirect variable expansion of strictly constructed environment variable names. In references/qa-execute-snippets.mjs, the skill executes shell snippets extracted from documentation only after they pass a strict SAFE_COMMANDS allow-list and while monitored by a sandbox sentinel that detects unauthorized file system access.

develop-task