The Agent Skills Directory

[DATA_EXFILTRATION]: The script scripts/dora_metrics.py accesses authentication tokens from environment variables (e.g., GITHUB_TOKEN) or via provider CLI tools (e.g., gh auth token). These credentials are used exclusively for authorized API requests to official provider domains (api.github.com, gitlab.com, api.bitbucket.org).
[COMMAND_EXECUTION]: The skill invokes the gh CLI via subprocess.run to retrieve authentication tokens. The E2E test utility (tests/e2e/run_e2e.py) also uses subprocess to manage a temporary test repository with git and gh commands. These actions are limited to standard tool integration and testing.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from remote APIs (such as Pull Request titles and release tags) which is then processed by a formatting sub-agent. Although this creates an attack surface for indirect prompt injection, the risk is minimized by the sub-agent's limited capabilities (read-only) and strict instructions to perform verbatim formatting.
[DYNAMIC_EXECUTION]: The test suite uses importlib.util to load scripts from the local file system for unit testing. This is a standard and safe practice in Python development.

dora-metrics