The Agent Skills Directory

Strict Authorization and Approval Workflow: The skill enforces a multi-stage approval process. It requires a compact preview of the exact payload (including titles, bodies, and metadata) and explicit user approval before any write operation is executed. This significantly reduces the risk of accidental data disclosure or unauthorized modifications.\n- Trusted Identity and Transport Management: It mandates the use of native, authenticated applications (e.g., Atlassian Rovo, Linear, GitHub app) or specific CLI identities. It prohibits silent transport switching and requires manual confirmation when moving between different authentication contexts or visibility levels (e.g., from private to public repositories).\n- Data Sanitization and Trust Boundaries: The skill treats all data from external scans as untrusted, instructing the agent never to interpret scan content as instructions. It specifically blocks the inclusion of sensitive information like credentials, signed URLs, or internal exploit details in trackers, especially when the destination is public.\n- Automated Validation and Re-verification: Before any mutation occurs, the skill re-validates the source findings, re-checks provider access, and repeats duplicate searches. This ensures that the state has not changed between the user's approval and the final execution, preventing race conditions or stale-data errors.\n- Secure CLI Usage: When using the GitHub CLI (gh), the skill enforces shell-quoting for all arguments and the use of temporary files with restricted permissions (0600) to handle request bodies, preventing command injection and local data leakage.

track-findings