The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill configures a GitHub Actions workflow that utilizes official actions from the actions/ and superfly/ GitHub organizations to set up the build environment and the flyctl command-line tool. These are well-known and trusted sources.
[COMMAND_EXECUTION]: The instructions and examples involve executing standard deployment and testing commands such as fly deploy, npm test, and curl for health checks, which are appropriate for the skill's stated purpose.
[CREDENTIALS_UNSAFE]: The skill correctly handles sensitive credentials by recommending the use of GitHub Secrets (${{ secrets.FLY_API_TOKEN }}) for authentication rather than hardcoding tokens. It also includes instructions to exclude tokens and environment values from CI output receipts.
[INDIRECT_PROMPT_INJECTION]: The skill contains potential surfaces for indirect prompt injection:
Ingestion points: Data is fetched from the Fly.io Machines API in tests/integration/fly.integration.test.ts.
Boundary markers: None explicitly defined in the provided tests.
Capability inventory: The skill uses Bash(fly:*) and Write capabilities.
Sanitization: The skill includes instructions to validate health results and stop on unexpected configuration, providing a level of verification for ingested data.

flyio-ci-integration