The Agent Skills Directory

[SAFE]: The skill documents defensive security controls for automation, such as pinning third-party actions to full commit SHAs, declaring minimum GITHUB_TOKEN permissions, and using persist-credentials: false to limit Git access.
[SAFE]: The skill includes instructions for using well-known services and trusted tools, including Playwright, axe-core, and the GitHub Accessibility Scanner, following established security patterns for these platforms.
[INDIRECT_PROMPT_INJECTION]: The skill explicitly recognizes the risk of indirect prompt injection when using AI for remediation and provides a mandatory security architecture to mitigate it.
Ingestion points: The skill identifies HTML, SVG, URLs, scan output, and issue comments as untrusted ingestion points for AI tools in SKILL.md.
Boundary markers: It recommends manual-trigger-only workflows, human triage, and isolated environments as boundaries to prevent automated exploitation.
Capability inventory: The described remediation workflows involve reading repository contents and writing patches to the filesystem.
Sanitization: The skill mandates passing untrusted values via environment variables or files and strictly prohibits direct interpolation into executable script text to prevent injection.

ci-cd