The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/card.py uses subprocess.run to call the external utility cosign for Sigstore-based signing and verification operations. This behavior is documented and necessary for the skill's primary purpose of artifact provenance.
[FILE_SYSTEM_ACCESS]: The skill performs recursive directory walks to compute file hashes for integrity manifests and writes several files to disk, including CARD.md and CARD.manifest.json. These operations are consistent with the tool's role as a manifest generator.
[REMOTE_CODE_EXECUTION]: The skill integrates with cosign (if present on the system path) to perform keyless signing via Sigstore. While this involves executing external code, it utilizes a well-known, established security protocol for its intended purpose.

trust-card