The Agent Skills Directory

[DATA_EXFILTRATION]: The skill facilitates the submission of project security data to the OpenSSF Best Practices platform. This process involves using session cookies as authentication tokens in the submit-badges.py script. The skill correctly implements these as user-provided inputs (via environment variables or local files) and provides clear warnings against hardcoding or mismanaging these sensitive credentials.
[COMMAND_EXECUTION]: The skill contains several utility scripts for verifying repository states. Specifically, verify-reproducible-build.sh handles the execution of build tools like go, docker, and npm. It employs a secure implementation using a strict allowlist to ensure only known, safe build commands are executed, preventing arbitrary command injection.
[PROMPT_INJECTION]: The skill ingests various project-local files (e.g., README.md, .github/workflows/*.yml) to perform security audits. While this constitutes an indirect prompt injection surface, the risk is mitigated by the fact that the skill uses these files as data for deterministic checks (regex, CLI tool execution) rather than using them to direct the agent's core behavioral logic.
[REMOTE_CODE_EXECUTION]: Documentation within the skill (references/quick-start-guide.md) provides examples of script installation. It promotes safe practices by instructing users to download and inspect scripts locally before execution, rather than recommending unsafe 'curl to bash' patterns.
[COMMAND_EXECUTION]: The skill includes instructions and scripts for the GitHub Actions environment, such as a command to free disk space using sudo rm -rf on specific system directories. In the context of a GitHub runner environment, this is a standard and benign performance optimization pattern.

enterprise-readiness