The Agent Skills Directory

[SAFE]: The skill provides security-focused advice for CI/CD pipelines. It explicitly warns against dangerous patterns like using pull_request_target with untrusted code, echoing secrets, or using long-lived credentials.
[SAFE]: The provided YAML skeleton follows least-privilege principles by setting contents: read at the workflow level and using OIDC (id-token: write) for deployments, which is a recommended security practice.
[SAFE]: The skill emphasizes pinning actions to a full commit SHA to prevent supply chain attacks through tag-jacking.

github-actions