The Agent Skills Directory

[SAFE]: The skill serves as a legitimate technical resource for configuring and running 'nektos act'. It includes best practices for security, such as reviewing workflow code and using disposable workspaces to mitigate risks associated with local execution.
[SAFE]: 'references/installation-runners.md' provides instructions for installing the tool via reputable package managers (Homebrew, WinGet, Chocolatey, Scoop) and highlights the importance of verifying binary integrity using SHA-256 checksums.
[SAFE]: The skill explicitly warns against insecure practices, including the use of 'curl | bash' installers and granting excessive permissions (e.g., world-writable chmod) to the Docker daemon socket.
[SAFE]: 'scripts/make-event.py' is a utility script that generates JSON payloads for testing GitHub Actions locally. The script performs basic validation on inputs and does not contain any suspicious network or filesystem operations.
[INDIRECT_PROMPT_INJECTION]: The skill facilitates the execution of GitHub Actions workflows, which are an ingestion point for potentially untrusted code from remote repositories or local files.
Ingestion points: GitHub workflow YAML files (.github/workflows/), event payloads (-e), and secret/environment files (.secrets, .env).
Boundary markers: The skill references the ACT environment variable and github.event.act context used to conditionally skip steps during local execution. It also recommends using --validate --strict flags.
Capability inventory: The 'act' tool can execute shell commands, manage Docker containers, access the filesystem, and perform network requests as defined in the workflows it runs.
Sanitization: The 'make-event.py' script ensures inputs follow a key-value format. The skill instructions emphasize manual review of all code before execution to prevent malicious side effects.

act