The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on shell scripts and Node.js to execute a variety of system commands including git, yarn, npm, and jq.
scripts/yarn-bump.sh orchestrates repository cloning, committing changes as a bot user, and pushing to remotes.
scripts/bump-yarn.js uses spawnSync to invoke yarn set version and yarn install --mode=update-lockfile to synchronize dependencies.
These executions are strictly scoped to the maintenance of the project dependencies as described in the skill's goal.
[EXTERNAL_DOWNLOADS]: The skill fetches data and binaries from the official NPM registry and Yarn's release infrastructure.
It uses npm view @yarnpkg/cli to resolve the latest Yarn 4.x version.
The yarn set version command is used to download the appropriate Yarn Berry .cjs binary into the project's local .yarn/releases directory.
These downloads originate from well-known, trusted package registries.
[PRIVILEGE_ESCALATION]: The script bump-yarn.js applies executable permissions to downloaded files.
It uses fs.chmodSync(p, 0o755) on the Yarn binary files within the repository to ensure they can be executed by the Node.js runtime.
This is standard and required behavior for Yarn Berry projects to function correctly.
[DATA_EXPOSURE]: The skill interacts with authentication tokens (GITHUB_TOKEN, GH_TOKEN, and PRIVATE_TOKEN) to facilitate automated CI/CD workflows.
The tokens are used to authenticate clones and PR/MR creation on Red Hat's GitHub and GitLab instances.
The usage pattern is consistent with legitimate automated service account behavior within the specified vendor's infrastructure.

rhdh-yarn-bump