The Agent Skills Directory

[SAFE]: The skill implements a secure release workflow for the 'mkit' project. All operations are documented with verification steps to ensure the integrity of the published artifacts.
[COMMAND_EXECUTION]: The skill uses standard development tools including git, cargo, npm, gh, and cosign. These are used appropriately within the context of software release management (e.g., tagging, building, publishing, and verifying signatures).
[EXTERNAL_DOWNLOADS]: The skill downloads binaries and configurations from official repositories belonging to the vendor ('officialunofficial/mkit' and 'officialunofficial/homebrew-tap'). It also interacts with standard package registries (crates.io and npm). These are verified using cryptographic signatures.
[PROMPT_INJECTION]: A static detector flagged a potential concealment pattern. Upon manual review, this is a false positive; the instruction to pipe secrets directly into gh secret set is a security best practice intended to prevent sensitive data from being written to disk, rather than an attempt to hide malicious activity from the user.
[DATA_EXFILTRATION]: No evidence of unauthorized data access or exfiltration. The skill follows least-privilege principles by using repo-scoped secrets for authentication.

mkit-release