The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill has a large ingestion surface as it audits repository files such as README.md, CONTRIBUTING.md, CLAUDE.md, and GitHub API outputs (issues/PRs).
Ingestion points: Audited repository files and gh-fetched text (specified in references/untrusted-content.md).
Boundary markers: The skill contains an explicit protection policy in references/untrusted-content.md instructing the agent to treat all repository content as data to be analyzed rather than instructions to be followed.
Capability inventory: The skill uses Bash, Write, and Edit tools; however, the instructions mandate that all modifications must be presented as a diff and require explicit human confirmation.
Sanitization: The skill instructs the agent to quote repository content as inert, attributed text to prevent restructuring of reports.
[EXTERNAL_DOWNLOADS]: The skill fetches configuration and templates from trusted sources.
Evidence: The skill proposes fetching .gitignore templates and LICENSE bodies directly from the official GitHub API (api.github.com).
Evidence: Templates provided for GitHub Actions reference trusted and well-known repositories such as actions/checkout, google-apis/release-please-action, and ossf/scorecard-action.
[COMMAND_EXECUTION]: The skill generates shell commands for repository management.
Evidence: Capabilities like security-policy and repo-infrastructure generate gh repo edit and gh api commands. These are documented to be shown to the user for manual execution rather than being run automatically by the agent, maintaining a safe trust boundary.

oss-repository-conventions