The Agent Skills Directory

[SAFE]: The skill is a specialized security auditor for GitHub Actions, focusing on identifying vulnerabilities in CI/CD pipelines.
[EXTERNAL_DOWNLOADS]: It utilizes gh api to fetch workflow files from GitHub repositories. This is a legitimate and expected behavior for the stated purpose of auditing remote repositories.
[COMMAND_EXECUTION]: The skill uses the Bash tool to interface with the GitHub CLI (gh). It contains explicit safeguards to treat all fetched content as data and never pipe it to interpreters like bash or eval, mitigating risks associated with processing untrusted workflow files.
[PROMPT_INJECTION]: The skill documents and analyzes prompt injection vectors in other workflows but does not contain injection instructions or bypasses itself.

claude-actions-auditor