The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted repository data, such as manifests, CI/CD scripts, and pull request metadata, to classify delivery shapes and align repository settings. * Ingestion points: Processes repository guidance, manifests, verification commands, and .github/ configurations (SKILL.md, references/deploy-workflows.md). * Boundary markers: Recommends explicit trust boundaries, such as using pull_request events with read-only credentials and pinning Actions to immutable SHAs (references/actions-security.md). * Capability inventory: Possesses capabilities to modify repository files, update live GitHub settings, and mint OIDC tokens for deployment (SKILL.md, references/repo-settings.md). * Sanitization: Instructs that downstream jobs should consume only sanitized outputs and validated manual inputs (references/actions-security.md).- [EXTERNAL_DOWNLOADS]: The skill references various external GitHub Actions and reusable workflows to perform security and deployment tasks. * Vendor resources: Calls the shared uinaf/.github/.github/workflows/scan.yml@main reusable workflow for security scanning. * Third-party actions: Recommends community tools including actions/checkout, pnpm/setup, dorny/paths-filter, cycjimmy/semantic-release-action, and specialized tools like pgaskin/push-signed-commits and @jno21/semantic-release-github-commit.- [COMMAND_EXECUTION]: Instructions include the execution of repository gates, validation tools, and build commands. * Validation tools: Recommends running actionlint and zizmor to verify workflow changes (SKILL.md). * Package managers: Uses pnpm, npm, and cargo commands for dependency management and release tasks.

gh-setup