The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/check_js_supply_chain.py uses subprocess.run to call the pnpm binary for version and configuration checks. These calls are implemented securely using a list of arguments without a shell, and the keys accessed are restricted to a predefined list of safe configuration parameters.
[CREDENTIALS_UNSAFE]: The skill implements auditing logic to detect potential secret exposure, such as toJSON(secrets) in CI workflows or tokens in .npmrc files. This is a diagnostic security feature intended to inform the user of risks in their own repository and does not involve the exfiltration or unsafe handling of those credentials by the skill itself.
[EXTERNAL_DOWNLOADS]: The documentation references the instructa/agent-skills GitHub organization for installation. These are standard references for skill distribution and do not involve unauthorized runtime downloads or remote code execution.
[PROMPT_INJECTION]: The SKILL.md instructions establish a safe operational workflow that requires the agent to perform read-only analysis and seek user approval before performing any modifications or package manager operations. No override or bypass patterns were detected.

package-security-check