The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the GitHub CLI (gh) to change repository visibility to public. This is a high-impact operation that exposes the entire repository history. The skill mitigates this risk by requiring explicit user confirmation and providing a --dry-run flag to report readiness without making changes.
[COMMAND_EXECUTION]: Executes administrative repository commands, including enabling Private Vulnerability Reporting and setting branch/tag rulesets to protect the repository after it becomes public.
[EXTERNAL_DOWNLOADS]: The skill performs a consumer-style installation using npx skills add to verify that the repository is correctly configured and to seed the catalogue telemetry. This involves downloading and executing skills from the repository being published.
[PROMPT_INJECTION]: The skill ingests untrusted data from the local skills.sh.json file. Ingestion points: The file is read and parsed during the pre-flight check in SKILL.md. Boundary markers: The skill uses json.load to validate the file structure. Capability inventory: The skill has access to gh, git, and npx. Sanitization: Basic JSON parsing is used to ensure the data is well-formed before it is used for skill grouping and descriptions.

publish-repo