The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/artifact_audit.py uses subprocess.run to execute git ls-files. This is used to identify large files tracked in the Git repository that should potentially be moved to release assets or ignored. The execution is controlled and restricted to the directory provided by the user via the --git-root argument.
[COMMAND_EXECUTION]: The test suite (tests/test_affordances.py and tests/test_artifact_audit.py) uses subprocess.run to execute the skill's own Python scripts for functional validation during testing.
[SAFE]: The skill implements proactive security checks in scripts/artifact_audit.py, such as detecting Zip Slip vulnerabilities (unsafe paths like .. or absolute paths) and identifying accidental source code or internal metadata leaks inside binary distribution packages.
[SAFE]: The scripts/affordances.py script acts as a read-only router that maps a JSON-defined state to specific local markdown playbooks, using strict path validation (is_relative_to) to prevent directory traversal.
[SAFE]: No network operations, data exfiltration patterns, or hardcoded credentials were detected. The skill emphasizes manual review and human-in-the-loop decisions for sensitive operations like history remediation or release publication.

distribution-first-release