The Agent Skills Directory

[SAFE]: The skill enforces the use of full commit SHAs for all third-party GitHub Actions (e.g., actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683) instead of floating tags. This practice significantly reduces supply-chain risk by ensuring the exact code being executed cannot be changed by moving a tag.
[SAFE]: Scaffolded workflows automatically include a top-level permissions: contents: read block. This follows the principle of least privilege, ensuring the default GITHUB_TOKEN has minimal access and protecting the repository from unauthorized write operations.
[SAFE]: The deployment template implements a secure credential handling pattern. It writes temporary SSH keys to the file system using printf (avoiding shell interpolation issues) and includes an always() cleanup step that deletes the key and known_hosts files regardless of whether the job succeeds or fails.
[SAFE]: The instructions explicitly forbid the agent and the operator from echoing secrets into logs. It includes specific guidance on using redirection or pipes to handle sensitive data without exposing it in job outputs.
[SAFE]: The skill promotes proactive security by including an optional dependency audit job in the test template using pip-audit for Python projects, which checks for known vulnerabilities in the supply chain.

setup-ci