The Agent Skills Directory

[Command Execution]: The skill executes a local Python validation script (validate_tracking_source.py) and interacts with the GitHub CLI (gh). This is a core part of its functionality to validate scan data and perform tracking mutations. Evidence found in SKILL.md.
[Untrusted Data Handling]: The skill processes external scan data from findings.json. It proactively addresses potential indirect prompt injection (Category 8) by instructing the agent to treat all ingested strings as untrusted data rather than instructions. Evidence found in SKILL.md workflow section 1.
[Secure File Handling]: To prevent sensitive data exposure in shell history or process logs, the skill utilizes temporary files with restricted permissions (mode-0600) when passing finding content to the GitHub CLI. Evidence found in SKILL.md workflow section 6.
[Authentication and Scope Management]: The instructions require explicit user approval for each provider (GitHub, Jira, Linear) and enforce strict scoping of tool access to specific, verified repositories and projects, preventing unauthorized data access. Evidence found in SKILL.md and reference files.

track-findings