The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references several official GitHub Actions and Docker actions in its workflow templates, including:
actions/checkout@v4 from the official GitHub organization.
actions/setup-node@v4 from the official GitHub organization.
actions/cache@v4 from the official GitHub organization.
actions/upload-artifact@v4 from the official GitHub organization.
actions/download-artifact@v4 from the official GitHub organization.
docker/login-action@v3 from the official Docker organization.
docker/build-push-action@v5 from the official Docker organization.
[INDIRECT_PROMPT_INJECTION]: The skill provides templates for defining workflow inputs and secrets that are later interpolated into shell commands.
It uses ${{ inputs.environment }} in a shell command: run: printf 'Deploying to %s\n' "$DEPLOY_ENVIRONMENT".
The skill mitigates this risk by including explicit security warnings: "Review untrusted event inputs, least-privilege permissions, protected environments and secret exposure before adoption."
It specifically warns about self-hosted runners: "never run untrusted fork PR code on a persistent privileged runner."
[SAFE]: The skill follows security best practices by recommending the use of GitHub Secrets for sensitive information, environment protection rules, and pinning third-party actions to immutable commit SHAs.

github-actions