The Agent Skills Directory

[COMMAND_EXECUTION]: The script bump_ark.py executes the gh CLI tool using the subprocess module. Technical review confirms that the script uses argument lists instead of shell strings and performs validation on user-provided inputs, such as verifying that PR numbers are numeric, which prevents command injection.
[EXTERNAL_DOWNLOADS]: The skill fetches pull request descriptions and commit data from the posit-dev/ark and posit-dev/positron repositories via the GitHub API. These network operations are authenticated through the user's existing GitHub CLI session and are limited to legitimate vendor resources required for the skill's functionality.
[SAFE]: The skill follows established security best practices for automating GitHub workflows. It does not employ obfuscation, persistence mechanisms, or unauthorized data exfiltration, and its behavior aligns strictly with its stated purpose of managing submodule bumps.

bump-ark