The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/ci_fetch.py uses subprocess.run to execute the gh (GitHub CLI) tool. This is necessary to fetch workflow and job data from GitHub repositories, relying on the user's existing GitHub authentication and environment.
[EXTERNAL_DOWNLOADS]: The skill recommends a setup procedure in scripts/shoot.mjs that involves downloading the playwright package and Chromium browser via npm. While this involves downloading external code, it targets a well-known package registry and service.
[INDIRECT_PROMPT_INJECTION]: The skill ingests job and step names from external GitHub Action runs, representing an attack surface where malicious content in a repository's CI history could attempt to influence the agent.
Ingestion points: scripts/ci_fetch.py fetches job data from the GitHub API; scripts/ci_compare.py and scripts/render.py process this data for reporting.
Boundary markers: No specific delimiters or instructions are used to isolate external CI data within the agent's context or reports.
Capability inventory: The skill can execute gh commands (scripts/ci_fetch.py), write to the local filesystem (scripts/render.py), and interact with Slack for file uploads (references/slack.md).
Sanitization: render.py uses html.escape for text displayed in reports, which provides protection against structural injection in the generated HTML but does not prevent logic-based injection if the agent interprets the output text.
[DYNAMIC_EXECUTION]: The scripts/shoot.mjs script dynamically locates and loads the playwright library using createRequire with computed paths (targeting the current working directory or a local cache directory in the home folder). This is used to resolve dependencies in various execution environments.

impact-report