The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses several scripts and commands to interact with the local environment. These include git for worktree management, gh (GitHub CLI) for pull request operations in the publish_quiz.py script, and npx for installing/adding skills. These operations are performed using standard argument lists that avoid shell injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: The documentation provides standard installation instructions for Claude Code and the skills CLI using curl | bash and npx. These are typical for developer tooling and point to the official installation sources for those platforms.
[CREDENTIALS_UNSAFE]: The skill actively promotes secure credential management. It includes a dedicated script (check-signing-safety.sh) to audit for accidentally committed Android keystores and enforces a policy of reading production signing keys strictly from environment variables, preventing them from being stored in the repository.
[DYNAMIC_EXECUTION]: The markdown-converter module utilizes uvx markitdown to convert various document formats. This is a legitimate use of the uvx tool for running the Microsoft markitdown utility without permanent local installation.
[OBFUSCATION]: The pr-quiz module uses Base64 encoding to store quiz answer keys within PR descriptions. This is a documented part of the quiz functionality and is used for data transport rather than concealing malicious code.

agent-skills