The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references several well-known and reputable GitHub Actions and utilities.
Includes actions/checkout, actions/setup-node, actions/setup-python, actions/setup-go, and actions/setup-java from GitHub's official organizations.
References high-quality community actions such as docker/build-push-action, softprops/action-gh-release, peter-evans/create-pull-request, and aquasecurity/trivy-action.
Mentions step-security/harden-runner, a recognized security tool for CI/CD environments.
[COMMAND_EXECUTION]: Provides instructions for local environment discovery and setup using standard tools.
Uses find, ls, and grep to analyze repository structure and tech stacks.
Mentions helm install for deploying the Actions Runner Controller from GitHub's container registry (ghcr.io).
Recommends utilities like pin-github-action and ratchet for workflow hardening.
[DATA_EXFILTRATION]: The skill actively teaches defensive measures against data exfiltration.
Detailed guidance on using OIDC (OpenID Connect) for AWS, GCP, and Azure to eliminate the need for storing permanent cloud credentials.
Instructions on using ::add-mask:: to prevent dynamic secrets from appearing in workflow logs.
Guidance on restricting pull_request_target to prevent unauthorized access to repository secrets by untrusted PRs.
[PROMPT_INJECTION]: Includes specific sections on preventing script injection within GitHub Actions workflows by advising against the direct use of expressions in shell scripts and recommending the use of environment variables instead.

github-actions-advanced