The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The generated workflows utilize standard, well-known GitHub Actions from trusted providers such as actions/checkout, actions/setup-go, actions/setup-node (GitHub), google-github-actions/auth, google-github-actions/get-gke-credentials (Google), and azure/setup-helm (Azure). It also utilizes specialized actions from the vendor lwlee2608/release-manifest and useblacksmith/* for CI acceleration, which are documented as part of the skill's intended functionality.
[INDIRECT_PROMPT_INJECTION]: The skill processes project-specific files like go.mod, package.json, and Chart.yaml to configure the CI/CD pipeline. While this presents an ingestion surface for external data, the instructions include validation steps for service names and configuration keys, and the behavior is limited to static file generation for a deployment workflow.
[COMMAND_EXECUTION]: The generated workflow includes shell commands for testing (go vet, make test, pnpm lint) and building Docker images. These are standard development tasks triggered within the isolated environment of a GitHub Actions runner and are gated by change detection logic.
[CREDENTIALS_UNSAFE]: The skill correctly instructs the user to store sensitive information, such as GCP service account keys (GCR_SA_KEY), in GitHub Secrets rather than hardcoding them in the workflow file. Default credentials provided in templates (e.g., POSTGRES_PASSWORD: postgres) are explicitly for local test services.

genesis-cicd