The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/read-credential.py executes the git command to identify the repository's root directory. This is used to locate the .env file for workspace-specific API keys. The command is executed using a fixed argument list without a shell, which is a standard and safe method for system introspection.
[SAFE]: The skill incorporates strong security controls for handling sensitive API keys. Instructions explicitly direct the agent never to print keys or include them in command-line arguments. The scripts/graphql utility uses curl with the -H @- flag, passing the Authorization header through standard input to prevent the key from appearing in process listings. Additionally, the credential reader validates environment variable names against a strict regex ([A-Z][A-Z0-9_]*) before processing them, preventing arbitrary environment access.

linear