The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources such as the GitHub API and local tool outputs (e.g., Hyperfine). This creates a potential attack surface for indirect prompt injection; however, the risk is mitigated by a dedicated Python helper script that performs comprehensive schema validation, type checking, and string length limits on all ingested content.
[DATA_EXFILTRATION]: The instructions incorporate explicit security guidelines to prevent credential exposure. The agent is directed to use specific jq filters that extract only the necessary timing and status fields from API responses, and the skill explicitly warns against capturing or storing tokens, environment dumps, or raw logs.
[COMMAND_EXECUTION]: The workflow involves executing standard command-line tools (gh, jq, hyperfine) and a local Python script for data processing. The provided shell examples follow security best practices, such as using temporary files for intermediate storage and avoiding any patterns that involve executing remote code directly.

ci-optimize