The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads the actionlint binary and an associated checksum file from a third-party GitHub repository (rhysd/actionlint).
Evidence: curl -fsSLO "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
[PRIVILEGE_ESCALATION]: The Linux installation script uses elevated permissions to move the downloaded binary to a protected system directory.
Evidence: sudo install -m 755 /tmp/actionlint /usr/local/bin/actionlint
[COMMAND_EXECUTION]: The skill executes shell commands to download, verify, extract, and run the linter.
Evidence: Use of curl, sha256sum, tar, and the actionlint binary itself.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted workflow files which could theoretically contain instructions intended to influence the agent's behavior during the linting process.
Ingestion points: The skill reads file content from .github/workflows/*.yml.
Boundary markers: None identified in the prompt instructions to the agent.
Capability inventory: The skill can execute the actionlint command and system utilities.
Sanitization: No explicit sanitization or filtering of the file content is performed before it is passed to the linter.

actionlint