The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of standard development tools including git, gh CLI, curl, and python3 for repository management, CI monitoring, and authentication workflows. These are well-defined and trace back to expected user-authorized tasks.
[EXTERNAL_DOWNLOADS]: The skill fetches data from official GitHub domains (api.github.com, github.com, uploads.github.com) to manage releases, pull requests, and CI logs. All downloads target the specific repository the user is working on.
[DATA_EXFILTRATION]: While the skill handles sensitive data like GitHub tokens and SSH keys, it does so within the context of standard authentication procedures. Instructions include warnings against echoing tokens and utilize secure storage methods like git config credential.helper store and ~/.config/gh/hosts.yml with restricted permissions (chmod 600).
[CREDENTIALS_UNSAFE]: The skill includes scripts (scripts/git-credential-token.py) designed to retrieve authentication tokens from the local Git credential store to enable API fallback when the CLI is unavailable. This is a functional requirement for the skill's operation and follows standard local access patterns.
[SAFE_PRACTICE]: The skill provides explicit security checklists for code reviews, highlighting the importance of checking for hardcoded secrets, SQL injection, and path traversal in the code being reviewed.

github