The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides an implementation example in SKILL.md that fetches a shell script from a remote URL (https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash) and pipes it directly into the bash interpreter using process substitution (bash <(curl ...)). This pattern is a critical security anti-pattern that allows for the execution of unverified remote code, creating a significant supply chain vulnerability if the remote source or transmission is compromised.
[EXTERNAL_DOWNLOADS]: The skill instructions frequently recommend downloading and executing external tools and scripts, including actionlint, opa (Open Policy Agent), semgrep, snyk, and various GitHub Actions. Many of these tools are downloaded from personal or non-whitelisted third-party repositories without integrity verification.
[COMMAND_EXECUTION]: The skill is designed to generate and execute complex shell commands and CI/CD pipelines. These operations often involve sensitive tasks such as secret injection, artifact signing, and production infrastructure management.
[PRIVILEGE_ESCALATION]: The documentation in references/security-gates.md provides instructions for privileged system operations, specifically using sudo to move binaries to system-wide paths (sudo mv opa /usr/local/bin/).

cicd-expert