The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes third-party GitHub Actions job logs, which represent an attack surface for indirect prompt injection.
Ingestion Points: Logs are fetched from the GitHub API using the gh CLI in the collect_runs.py script.
Boundary Markers: The skill uses a dedicated module untrusted_wrap.py to wrap untrusted log content in nonce-bearing delimiters (--- BEGIN/END UNTRUSTED LOG CONTENT ---) to prevent the agent from interpreting log text as instructions.
Capability Inventory: The skill can execute shell commands via subprocess.run and write files to the local workspace.
Sanitization: The skill redacts credential-shaped strings (tokens, keys, passwords) from the logs before they are quoted in the report or processed by the agent. Additionally, SKILL.md contains explicit instructions to the agent to treat log data as untrusted.
[COMMAND_EXECUTION]: The skill makes extensive use of the system shell and external CLI tools to perform its audit functions.
Evidence: Python scripts such as run.py, scan.py, and collect_runs.py use subprocess.run to invoke git and the gh CLI.
Context: These executions are necessary for the skill's primary purpose and are performed using fixed command structures on validated inputs (e.g., repository roots resolved from the environment).
[EXTERNAL_DOWNLOADS]: The skill instructs the user to install a third-party Python package and uses the gh CLI for data collection.
Evidence: SKILL.md specifies the requirement for PyYAML (pip install pyyaml) and the GitHub CLI (gh).
Context: Both are well-known and trusted tools/libraries in the development ecosystem. No other non-standard external dependencies are downloaded at runtime.

ci-speedup