The Agent Skills Directory

[COMMAND_EXECUTION]: The audit script scripts/check_release_setup.py utilizes subprocess.run to execute git tag --list. This is a read-only command used to verify that the project version and git tags are synchronized. The implementation uses a list of arguments rather than a shell string, preventing shell injection vulnerabilities.
[INDIRECT_PROMPT_INJECTION]: The skill processes external repository data through the check_release_setup.py script, which parses pyproject.toml, uv.lock, and GitHub Actions workflow files. The script safely ingests this data using the standard tomllib parser and regular expressions to identify configuration risks, such as unpinned actions or dangerous triggers like pull_request_target.
[EXTERNAL_DOWNLOADS]: The instructions and workflow templates reference standard, well-known tools from the Python ecosystem, including uv, twine, and official GitHub Actions from the pypa and astral-sh organizations. All references in the provided templates are pinned to specific commit SHAs, which is a significant security mitigation against supply chain attacks.
[CREDENTIALS_UNSAFE]: The skill actively improves credential security by providing detailed instructions on migrating from long-lived PyPI API tokens to short-lived OIDC identities (Trusted Publishing). It includes checks in the audit script to identify and warn users about leftover legacy tokens.

python-release