The Agent Skills Directory

[COMMAND_EXECUTION]: All shell operations are performed locally using standard git and gh CLI tools. These are used strictly for repository metadata collection (e.g., retrieving the HEAD SHA, checking the dirty status of the working tree, and parsing the repository slug from origin URLs) and verifying user access to a repository before cloning. All target paths are normalized to the repository top level to prevent partial views.
[DYNAMIC_EXECUTION]: Sub-modules are loaded using importlib.util.spec_from_file_location. The paths for these imports are strictly anchored to the skill's own script directory, ensuring that the agent only executes trusted logic shipped with the skill rather than arbitrary code from the scanned repository.
[INDIRECT_PROMPT_INJECTION]: The skill defines a potential attack surface by ingesting and processing untrusted GitHub Actions workflow YAML files. However, the instructions in SKILL.md and references/close-contract.md specifically mandate that the agent must treat external content (like PR diffs) as factual reference only and ignore any instructions embedded within them. The parsing logic in scripts/practice_facts.py is structure-aware rather than substring-based, which prevents false positives or malicious signals from being triggered by comments in the analyzed files.
[DATA_EXFILTRATION]: The skill operates locally and does not perform any network requests in its primary scripts. Network operations mentioned in the instructions (such as cloning or resolving action tags via git ls-remote) are explicitly governed by an 'ask-before-network' policy and require user confirmation.

ci-score