The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill configuration and templates involve downloading packages and binaries from well-known services.
Fetches dependencies via npm and npx from the official npm registry.
Downloads browser binaries for Playwright using the npx playwright install command.
Utilizes the Vercel CLI for automated deployments and preview environments.
[INDIRECT_PROMPT_INJECTION]: The skill recommends a feedback loop where the agent processes external error logs to diagnose and fix pipeline failures.
Ingestion points: External CI failure output (logs) is pasted into the agent's context (referenced in the 'Feeding CI Failures Back to Agents' section of SKILL.md).
Boundary markers: Absent; the instructions do not suggest using specific delimiters or 'ignore' instructions for the log content.
Capability inventory: The agent is instructed to run commands such as npm run lint --fix, modify source code, and perform git commits based on the provided log data.
Sanitization: Absent; logs are treated as natural language input without pre-processing or sanitization.
[METADATA_POISONING]: There is an attribution discrepancy in the skill's metadata.
The YAML frontmatter identifies the source as a repository by Addy Osmani (addyosmani/agent-skills), while the provided author context indicates the skill is authored by 'sickn33'.
[COMMAND_EXECUTION]: The provided GitHub Action template for rollbacks incorporates user-provided input directly into a shell command.
The Rollback workflow snippet uses ${{ inputs.version }} inside the npx vercel rollback command. If this workflow is triggered with unsanitized input strings, it could serve as a vector for command injection within the CI environment.

ci-cd-and-automation