The Agent Skills Directory

[COMMAND_EXECUTION]: The skill implements a 'Project hook contract' that parses and executes shell commands defined in a .releaserc.yml file. Specifically, it supports prepare_artifact and publish_artifact hooks which are executed via the shell.
Evidence: SKILL.md defines a workflow that reads release.hooks from .releaserc.yml and executes them using placeholders like {project_root} and {target}.
[REMOTE_CODE_EXECUTION]: The skill uses the GitHub CLI (gh) to fetch data and perform actions, and it encourages the installation of the skill itself via npx skills add, which involves fetching and executing remote code from a GitHub repository.
Evidence: INSTALL.md recommends npx skills add RuralNative/RuralNative-SKILLS --skill release-skills.
[EXTERNAL_DOWNLOADS]: The skill requires the presence of the GitHub CLI (gh) and performs network operations to list, view, and create releases on GitHub.
Evidence: SKILL.md contains commands such as gh release list, gh pr view, and gh release create.
[DATA_EXFILTRATION]: While not directly malicious, the skill's ability to read repository secrets (via environment variables or .env files if processed by hooks) and transmit them via the publish_artifact hook or gh release commands constitutes a data exposure surface.
Evidence: The hook mechanism allows arbitrary shell commands to be executed, which could be used to exfiltrate files or environment variables.

release-skills