The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The AI code review workflow defined in assets/claude-code-review.yml ingests untrusted pull request data, creating a potential vector for malicious instructions to influence the agent's behavior. * Ingestion points: PR diffs and metadata are retrieved in assets/claude-code-review.yml using gh pr diff and gh pr view. * Boundary markers: The workflow prompt uses Markdown headers to organize instructions, though it does not explicitly direct the AI to ignore instructions found within the PR content. * Capability inventory: The workflow uses Bash(gh pr comment:*) and inline comment tools to post results back to GitHub. * Sanitization: External PR data is interpolated directly into the AI prompt without specific sanitization.
[EXTERNAL_DOWNLOADS]: The skill setup instructions and CI workflows automate the download of additional Go-related skills from github.com/samber/cc-skills-golang using the npx skills add command.
[COMMAND_EXECUTION]: The provided GitHub Action workflows (assets/test.yml, assets/docker.yml, assets/release.yml) execute various shell-based tools including go, docker, goreleaser, and the GitHub CLI (gh) to perform project tasks.
[PRIVILEGE_ESCALATION]: Workflows for automated merging (assets/dependabot-auto-merge.yml) and releases (assets/release.yml) utilize elevated GitHub token permissions, specifically contents: write and pull-requests: write. The skill provides extensive documentation in references/repo-security.md detailing these risks and recommending branch protection rules as a necessary security foundation.

golang-continuous-integration