The Agent Skills Directory

[COMMAND_EXECUTION]: The skill interacts with local container runtimes (Podman or Docker) and Git through Python's subprocess.run module. These calls are implemented using argument lists rather than shell strings, which mitigates the risk of command injection.
[EXTERNAL_DOWNLOADS]: The skill retrieves plugin definitions and configuration metadata from the vendor's official GitHub repositories (e.g., redhat-developer/rhdh-plugin-export-overlays). This network activity is limited to fetching data required for plugin management and does not involve executing remote code.
[CREDENTIALS_UNSAFE]: While the skill manages .env files that may contain secrets, it includes explicit instructions for the AI agent to avoid reading these secrets into the conversation context. It also provides warnings to the user if a backup archive contains sensitive environment files.
[DATA_EXPOSURE]: The restore functionality in backup.py incorporates security checks to prevent path traversal attacks by validating that all members of a backup archive are regular files or directories and that their final extraction path remains within the intended workspace.

rhdh-local