The Agent Skills Directory

[SAFE]: The skill architecture is built on secure-by-default principles, specifically emphasizing OIDC trusted publishing (PEP 740) to minimize credential exposure risks.
[SAFE]: All provided GitHub Action workflow examples implement full 40-character commit SHA pinning for external dependencies, protecting the user from mutable tag hijacks.
[COMMAND_EXECUTION]: The script check_release_setup.py uses subprocess.run to call git tag --list. This is implemented using a static argument list and a hardcoded command, which is a safe and standard method for read-only system introspection.
[EXTERNAL_DOWNLOADS]: The skill references and downloads configuration from well-known technology organizations and official registries (GitHub, PyPI, Google, Astral). These downloads are restricted to reputable tooling and documentation without any execution of untrusted remote code.

python-release