The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references and uses an unverified external GitHub Action, Woody4618/squads-program-action@v0.4.0, in its workflow examples. This repository is not maintained by the skill author (widnyana) or a recognized trusted organization.\n- [CREDENTIALS_UNSAFE]: The workflow templates in examples/anchor-upgrade.yml and examples/metadata-upgrade.yml explicitly instruct users to provide their Solana private key (secrets.KEYPAIR) to the unverified third-party action. Private keys should never be shared with untrusted external code.\n- [DATA_EXFILTRATION]: By granting an untrusted GitHub Action access to a Solana private key, the skill creates a high risk that the key could be exfiltrated or used to sign unauthorized transactions.\n- [REMOTE_CODE_EXECUTION]: The skill triggers the execution of remote code from an unverified repository through the GitHub Actions environment, which represents a supply-chain attack vector.\n- [PROMPT_INJECTION]: The skill documentation includes language that downplays the risk of sharing sensitive credentials, stating that the keypair "only needs transaction creation permission." This is a misleading instruction that may lead users to ignore standard security protocols for private key isolation.

Solana Squads Upgrade