The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides instructions and scripts that reference downloading the uv package manager from https://astral.sh/uv/install.sh. Astral is a well-known and recognized service provider in the Python ecosystem.
[REMOTE_CODE_EXECUTION]: The scripts/publish-to-pypi.sh script and SKILL.md contain references to installing uv via a piped shell command (curl -LsSf ... | sh). This is provided as an installation instruction for the user and as a fallback recommendation in error messages rather than being automatically executed by the skill itself. The source is a well-known service.
[COMMAND_EXECUTION]: The skill relies on several CLI tools including git, doppler, uv, and curl to manage the publishing workflow. These tools are used for their intended purposes (version control, secret retrieval, package building/uploading, and network verification).
[SAFE]: The skill implements security best practices by enforcing a local-only publishing policy (ADR-0027) and using Doppler to avoid hardcoding PyPI tokens or storing them in insecure environment variables like GitHub Secrets.

pypi-doppler