The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from project files such as package.json, .npmrc, and lockfiles to generate or repair GitHub Actions workflows. A malicious actor could attempt to influence the generated YAML output by placing specific instruction-like strings within these metadata files. Evidence: Step 1 of the Workflow section in SKILL.md identifies ingestion points (package.json, .npmrc, lockfiles, existing workflows). Capabilities: The skill generates YAML files containing shell commands and runner configurations. Sanitization: The skill does not explicitly mention sanitizing or escaping the values read from these files before interpolation. Boundary markers: None are specified to delimit processed data from instructions.
[COMMAND_EXECUTION]: The workflow template generated by the skill executes several shell commands for dependency installation, package packing, and publishing (e.g., pnpm install, pnpm pack, npm publish). These are necessary for the skill's primary function of managing CI/CD pipelines. Security is mitigated by the explicit recommendation to use --ignore-scripts and --frozen-lockfile in the execution steps.
[EXTERNAL_DOWNLOADS]: The skill instructs the agent to create workflows that download and execute official GitHub Actions (actions/checkout, upload-artifact, download-artifact) and the pnpm/setup action from the GitHub Marketplace. It also suggests using npx actions-up for pinning dependencies and may execute npm install -g npm to upgrade the CLI. These resources are fetched from well-known and reputable services (GitHub, npm registry).
[SAFE]: The skill actively promotes a hardened security posture. It mandates OIDC trusted publishing to replace long-lived tokens, requires full commit SHA pinning (rejecting mutable tags) to defend against supply chain attacks, and enforces explicit least-privilege permissions (e.g., contents: read, id-token: write) for the GitHub token environment.

npm-trusted-publishing-github-workflow