The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides specific shell commands for the agent to execute during security audits. These include searching for hardcoded secrets and sensitive files using grep, find, and git ls-files, as well as performing static analysis of workflow files using the zizmor security tool.
[EXTERNAL_DOWNLOADS]: The skill references and provides installation instructions for established security tools such as gitleaks, trufflehog, and zizmor via the Homebrew package manager. These are standard tools in the security industry for secrets verification and CI/CD hardening.
[SAFE]: The skill enforces high-standard security best practices for GitHub Actions, including mandatory 40-character SHA pinning for actions, least-privilege permissions, and proper shell variable handling to prevent command injection. The guidelines are designed to mitigate supply-chain and privilege escalation risks.

secure-github-actions