The Agent Skills Directory

[COMMAND_EXECUTION]: The skill performs GitHub API operations and integrates with other local scripts (treesitter and taxonomy) by executing commands through the gh CLI and bash. These calls are implemented using subprocess.run with argument lists, which is the recommended secure method to prevent command and shell injection vulnerabilities.\n- [EXTERNAL_DOWNLOADS]: The run.sh script manages its own Python environment and may download the typer and rich libraries from the Python Package Index (PyPI). These are well-known, legitimate libraries used for CLI development and output formatting. The use of these external resources follows established standards for AI agent skills.\n- [SAFE]: The skill processes untrusted data from GitHub (e.g., README files and source code) as part of its primary research purpose. This ingestion is handled through safe API parsing (Base64 decoding and JSON loading) and does not exhibit patterns of malicious instruction following or data exfiltration. The skill also enforces limits on file size and search result counts to ensure predictable behavior and resource usage.

github-search