The Agent Skills Directory

[COMMAND_EXECUTION]: The skill generates and recommends execution of bash scripts (.sh). The provided template.sh contains standard shell commands for user interaction (read), file operations (grep, mv, printf), and environment management. These are used strictly for the stated purpose of capturing and saving configuration values provided by the user.
[CREDENTIALS_UNSAFE]: The skill is designed to handle credentials but does so using security best practices. It uses ask_secret (hidden terminal input) for capturing passwords/keys and set_secret (using the official GitHub CLI) for CI secrets. It writes sensitive data to a local .env file, which is the standard development practice for local secret management.
[EXTERNAL_DOWNLOADS]: The open_url function opens links in the user's default browser (e.g., Stripe dashboard). This is a user-initiated action and does not involve downloading or executing remote code within the agent context. All URLs are intended for manual human interaction.
[PRIVILEGE_ESCALATION]: The skill uses chmod +x to make the generated scripts executable. This is a standard and necessary operation for the script to run as intended and does not grant the script or the agent elevated system privileges.
[DATA_EXFILTRATION]: No evidence of unauthorized data transmission was found. Network operations are limited to the GitHub CLI (gh) for setting repository secrets, which is a legitimate and documented use case for this tool.

wizard