The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill retrieves the user's GitHub authentication token via gh auth token and propagates it as a repository secret (HOMEBREW_TAP_TOKEN) in the generated project. The token is also interpolated directly into a Git clone URL (https://x-access-token:$(gh auth token)@github.com/...), which can lead to credential exposure in process lists or environment logs.\n- [COMMAND_EXECUTION]: The scaffolding workflow involves multiple shell operations (such as gh repo create, go mod init, and mv) that interpolate user-supplied parameters like {name} and {description}. The instructions do not explicitly require the agent to sanitize or escape these variables, creating a potential surface for command injection if malicious input is processed.\n- [EXTERNAL_DOWNLOADS]: The skill automates the installation of several development tools and libraries from external registries during the setup phase. This includes Go-based tools (Cobra, Lefthook, GoReleaser, golangci-lint) and Python packages (Typer, Ruff, Mypy, Pytest) fetched from their respective official repositories and registries.

create-cli