The Agent Skills Directory

[SAFE]: The skill is a collection of best practices and administrative automation for GitHub repositories. All included scripts and instructions serve the stated purpose of repository management and security hardening.
[COMMAND_EXECUTION]: The skill provides automation scripts such as scripts/init-branch-protection.sh and scripts/verify-github-project.sh. These scripts use the gh (GitHub) and git command-line interfaces to perform administrative tasks like fetching repository metadata, applying branch protection settings, and verifying project configuration. These operations are standard for repository maintenance.
[EXTERNAL_DOWNLOADS]: Reference documentation (references/actionlint-guide.md) provides instructions for installing well-known development utilities like actionlint via official GitHub releases and Docker. These are presented as guidance for users to improve their repository's CI/CD quality.
[INDIRECT_PROMPT_INJECTION]: The skill includes detailed guides (references/workflow-bash-patterns.md) on how to detect and mitigate command injection vulnerabilities in GitHub Actions, particularly when handling untrusted data like issue titles or PR bodies. This indicates a strong focus on defensive security practices.
[DYNAMIC_EXECUTION]: The checkpoints.yaml file contains Bash and Python snippets used for auditing repositories. For example, it includes a Python script that uses yaml.safe_load to statically analyze GitHub Actions workflows for security configuration. These scripts are intended for local audit purposes and do not execute untrusted external code.

github-project