The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/check_actions_versions.py executes gh auth token via subprocess.run to retrieve an authentication token if environment variables are missing. This is a legitimate use of the GitHub CLI for authentication to a well-known service.
[EXTERNAL_DOWNLOADS]: The skill queries the official GitHub API (https://api.github.com) to fetch release and tag information for GitHub Actions. These are standard operations for a version management tool targeting a well-known service.
[INDIRECT_PROMPT_INJECTION]: The script processes external data from the GitHub API and local workflow files. It uses regular expressions and JSON parsing to extract version strings and does not execute the processed data as code, presenting a minimal risk surface.
[SAFE]: The skill promotes secure development practices, such as Conventional Commits, Semantic Versioning, and explicit version pinning in GitHub Actions workflows. All operations are transparent and follow industry standards.

git-github