The Agent Skills Directory

Security Guardrails: The skill explicitly implements a set of constraints that prevent the agent from performing autonomous sensitive actions. This is a positive security pattern that ensures human-in-the-loop verification for operations such as pushing code, creating pull requests, and publishing packages.
Local Command Execution: The instructions include several npm run commands (e.g., build, test, change, prebuild) and references to project-specific scripts like checkchange.mjs. These are standard development tasks within the context of a monorepo and are intended to be executed locally by the developer or agent to ensure code quality.
Environment and Identity Context: The skill mentions usage of $GITHUB_ACTOR and gh api user within the context of explaining how the repository's internal CI/CD logic (specifically for Beachball change files) verifies permissions. This is a descriptive explanation of existing repository policy rather than an attempt to exfiltrate credentials.
Use of Internal References: The skill directs the agent to read internal documentation and templates (e.g., CONTRIBUTING.md, pull_request_template.md). This promotes consistency with project standards and does not involve untrusted external sources.

shipping