The Agent Skills Directory

[SAFE]: The skill acts as a passive reference library for doctrine and methodology. It explicitly prohibits itself from creating, modifying, or deleting files in its core rules.
[CREDENTIALS_UNSAFE]: The skill implements a robust security layer via the 'Secret Hygiene' (references/secret-hygiene.md) and 'Critical Rule #1' doctrine. It mandates that agents use secrets by name only, never open .env or .auth/ files, and avoid commands that print environment values (e.g., printenv, echo $SECRET).
[DATA_EXFILTRATION]: The skill includes an 'Upstream Feedback' (references/upstream-feedback.md) protocol that enforces a 'Redaction Gate'. This ensures Jira keys, hostnames, and sensitive local paths are stripped from drafts before any data is sent to external repositories.
[REMOTE_CODE_EXECUTION]: The skill documents the use of standard tools like uvx and bunx for launching MCP servers (e.g., mcp-atlassian, varlock). These are presented as user-controlled configuration examples rather than autonomous execution paths.
[COMMAND_EXECUTION]: The instructions guide agents to use standard CLI tools (curl, gh, bun) with specific flags to prevent accidental credential leakage (e.g., using --raw with playwright-cli to suppress typed passwords in logs).

agentic-qa-core