The Agent Skills Directory

[SAFE]: The skill uses standard Go ecosystem tools (go, git, gh, goreleaser, cosign, syft) for their intended purposes in a release workflow.
[EXTERNAL_DOWNLOADS]: Communicates with well-known services including proxy.golang.org, sum.golang.org, pkg.go.dev, and github.com. These are official infrastructure for Go and GitHub respectively.
[COMMAND_EXECUTION]: Executes documented shell commands for release automation. Procedures like using sed for import rewriting during major version migrations follow standard Go conventions.
[CREDENTIALS_UNSAFE]: secret management practices are sound. The skill instructs the user to provide authentication tokens (e.g., GH_PAT, GITHUB_TOKEN) via environment variables or GitHub Secrets rather than hardcoding them or storing them insecurely.
[PROMPT_INJECTION]: While the skill ingests data from local project files (e.g., go.mod, CHANGELOG.md), it uses this data for structured versioning and release notes, posing a minimal risk of indirect prompt injection.

go-release