The Agent Skills Directory

[SAFE]: The skill implements security best practices by requiring bundle-audit (to check for vulnerable gems) and brakeman (a static analysis security tool for Rails) in the CI pipeline.
[COMMAND_EXECUTION]: The skill executes standard Ruby and Rails development commands (e.g., bundle install, rails db:migrate, ruby -v) as part of its project bootstrapping functionality. These operations are restricted to the local development environment and are appropriate for the skill's stated purpose.
[SAFE]: The skill strictly enforces pinning GitHub Actions to full commit SHAs rather than version tags (e.g., actions/checkout@34e1148...), which protects against supply chain attacks where a tag could be surreptitiously moved to malicious code.
[SAFE]: The skill includes a "System Modification Approval Gate" which requires explicit user confirmation and explanation before the agent performs actions that modify the host environment, ensuring user oversight for potentially sensitive changes.

setup