The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill determines project configurations and package managers by parsing files such as package.json, go.mod, Cargo.toml, and Gemfile. If these files contain maliciously crafted content, they could potentially influence the instructions generated by the agent or lead to the injection of unauthorized commands into the resulting GitHub Action workflows.
Ingestion points: Project configuration files including package.json, requirements.txt, pyproject.toml, setup.py, Cargo.toml, Gemfile, and various lockfiles (e.g., pnpm-lock.yaml, yarn.lock, package-lock.json).
Boundary markers: No explicit delimiters or sanitization rules are provided to the agent for processing these untrusted project files during detection and template interpolation.
Capability inventory: The agent has the ability to read and write files within the repository and execute shell commands via the gh CLI.
Sanitization: There are no instructions to validate or escape strings retrieved from project metadata before they are interpolated into workflow templates or shell commands.
[COMMAND_EXECUTION]: The skill utilizes the gh (GitHub CLI) to perform network-based operations, specifically for resolving release tags and branches to immutable commit SHAs. While this is used to implement a security feature (action pinning), it requires the agent to execute shell commands that interact with external APIs.
[EXTERNAL_DOWNLOADS]: The instructions recommend the use of various third-party GitHub Actions, including pnpm/setup, astral-sh/setup-uv, and ruby/setup-ruby. These are standard developer tools from well-known organizations, and the skill includes specific rules to mitigate supply-chain risks by pinning these dependencies to full commit SHAs.

github-actions