The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes a local verification script, scripts/check_workflows.py, which is used to statically audit generated YAML files for security best practices. This script uses standard Python libraries to identify common misconfigurations like unpinned actions or broad permissions.\n- [EXTERNAL_DOWNLOADS]: The skill references official documentation and APIs from trusted platforms such as GitHub, Node.js, and package manager sites. These references are used to obtain security information, such as resolving action SHAs, following standard development practices.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes project metadata like package.json to configure CI matrices. It addresses the inherent injection risks by implementing validation logic in its checker script and enforcing the use of immutable identifiers and restricted permissions in the output workflows.

node-ci