The Agent Skills Directory

[SAFE]: The skill provides instructions for handling sensitive information such as code signing certificates (.p12), App Store Connect API keys (.p8), and Sparkle private keys. It guides users to encode these using base64 and copy them to the clipboard using pbcopy for insertion into GitHub Secrets. This is a standard and secure practice for CI/CD setup, ensuring secrets are not hardcoded or stored in the repository.- [SAFE]: The skill refers to several utility scripts (e.g., verify-p12.sh, combine-cert-key.sh) and standard development tools like tuist, xcodebuild, and codesign. These commands are used within their intended context for building, signing, and verifying macOS applications.- [PROMPT_INJECTION]: The skill describes a process where release notes are automatically extracted from the CHANGELOG.md file. While this represents a surface for indirect prompt injection, it is a standard automated documentation practice and does not pose a direct threat to the agent's execution environment.

github-actions