The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill's reference sheets provide implementation examples that utilize official and trusted GitHub Actions, including sigstore/cosign-installer, anchore/sbom-action, docker/build-push-action, aquasecurity/trivy-action, semgrep/semgrep-action, gitleaks/gitleaks-action, aws-actions/configure-aws-credentials, and opentofu/setup-opentofu. It also references hardened container base images from trusted registries such as cgr.dev/chainguard and gcr.io/distroless.
[INDIRECT_PROMPT_INJECTION]: The skill establishes personas and workflows for the agent to perform audits and reviews of user-provided CI/CD pipelines and infrastructure manifests. This creates an ingestion surface for untrusted data. However, the skill provides only instructional context for text-based analysis and contains no executable code or capabilities that would allow for the execution of instructions embedded in the analyzed data.

using-devops-engineering