The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill includes a runtime-bootstrap.mjs script that downloads manifests and components for the optional local runtime from official GitHub releases. The process incorporates SHA-256 integrity verification and Cosign attestation checks to ensure that only authentic and untampered artifacts are installed.
[COMMAND_EXECUTION]: Automated release sequences rely on standard CLI tools such as git, gh, glab, and fastlane. These operations are conducted through a durable state wrapper that ensures crash-safety and idempotency, providing the user with a transparent narration of all actions being performed.
[CREDENTIALS_UNSAFE]: Deployment workflows manage sensitive API keys and certificates for platforms like the Apple App Store and cloud hosting providers. The skill enforces secure storage by setting strict POSIX permissions (0600) on credential files and uses a redaction engine to scan PR bodies and documentation for secrets before transmission.
[DATA_EXFILTRATION]: Application binaries and release metadata are transmitted to external services as part of the intended deployment process. Risk is mitigated by performing automated redaction scans on all public-facing content and maintaining strict 'report-only' vs 'mutation' boundaries that require affirmative user consent for transfers.

ship