The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes multiple shell commands using the gh CLI, git, and the Go toolchain (go mod tidy, go test) to automate the repository update workflow.
[EXTERNAL_DOWNLOADS]: It clones external Go repositories to a local temporary directory (/tmp/go-bump/) for analysis and testing. It also relies on the external gh oss-watch extension.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources including go.mod files, PR titles, and issue lists. While this presents an attack surface where malicious repository content could influence the agent, the skill implements three distinct confirmation gates (Gate 1: Investigation review, Gate 2: PR creation review, Gate 3: Merge review) to ensure user oversight.
Ingestion points: Repository metadata from gh oss-watch, go.mod file contents, CI strategy workflows, PR/issue lists, and test outputs.
Boundary markers: The workflow explicitly separates investigation, testing, and execution phases with mandatory reports and confirmation prompts to the user.
Capability inventory: File system read/write, git clone/push, gh api/pr/issue operations, and execution of the Go toolchain.
Sanitization: The skill does not explicitly sanitize file contents but requires the user to manually review the investigation summary and test results before proceeding.
[DYNAMIC_EXECUTION]: The skill executes go test ./... in Step 3, which involves compiling and running code found within the cloned repositories. This is a standard developer workflow but represents the execution of code derived from external sources.

gh-oss-go-bump