The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the Bash tool to perform local reconnaissance of the project structure.
It executes ls -a and cat on standard manifest files (e.g., package.json, pyproject.toml, go.mod, Cargo.toml) to identify the language, framework, and deployment requirements.
It uses grep to detect the presence of platform-specific config files like fly.toml or vercel.json.
[EXTERNAL_DOWNLOADS]: The skill generates YAML configurations that incorporate external GitHub Actions from trusted sources.
Templates include actions from official organizations such as GitHub (actions/*), Astral (astral-sh/*), Google (google-github-actions/*), and Fly.io (superfly/*).
Best Practice Observed: All referenced actions are pinned by immutable commit SHAs (e.g., actions/checkout@11bd719...) rather than tags, which protects against upstream supply chain compromises.
[CREDENTIALS_UNSAFE]: The skill actively guides the user toward secure practices.
It includes a "Secrets Checklist" that instructs the agent to never hardcode values and explicitly directs users to configure sensitive data like GCP_SA_KEY or DATABASE_URL in the platform's native secret manager.
[SAFE]: The skill's behavior is consistent with its stated purpose as a DevOps automation tool. It performs read-only operations on project metadata and writes configuration files without attempting to exfiltrate data or perform unauthorized modifications.

relay-pipeline