The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/fetch_schedule.py executes a local CLI tool called gog using subprocess.run. The execution is performed with shell=False, which prevents shell-level command injection. The tool is used to fetch schedule data from a specific Google Sheets ID provided as an argument.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources including Jira tickets and third-party lifecycle pages.
Ingestion points: Jira ticket descriptions (ADF format) in workflows/review-test-plan.md and lifecycle content from URLs listed in references/sources.md.
Boundary markers: The skill implements a strict review process where it presents a diff and requires line-by-line approval from the user before proceeding to Step 7 (Jira update).
Capability inventory: The skill can update Jira descriptions, post comments, and create child tasks through /rhdh-jira-update and /rhdh-jira-create.
Sanitization: The skill normalizes version strings and dates to specific formats (major.minor and YYYY-MM-DD) before processing, which acts as a validation layer.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill does not contain hardcoded credentials and uses existing authenticated tools (acli for Jira and gog for Google Sheets) for data access. All network references target well-known and trusted technology domains (Red Hat, AWS, Microsoft, Google, Backstage.io).

rhdh-test-plan-review