The Agent Skills Directory

[SAFE]: The skill provides legitimate best practice guidance for managing Chromatic, a widely used visual testing service for Storybook. The instructions focus on improving CI performance and managing snapshot costs.
[REMOTE_CODE_EXECUTION]: The skill references the use of official GitHub Actions such as chromaui/action, actions/checkout, and actions/github-script. These are standard tools for CI/CD automation and are used here in a conventional, safe manner.
[COMMAND_EXECUTION]: The documentation suggests incorporating shell script snippets within GitHub Action workflows to handle conditional logic, such as skipping builds based on PR labels. These are standard DevOps practices and do not involve untrusted command execution.
[CREDENTIALS_UNSAFE]: The skill correctly identifies the need for a CHROMATIC_PROJECT_TOKEN and provides examples of accessing it via GitHub Secrets, which is the recommended secure way to handle credentials in CI environments.
[INDIRECT_PROMPT_INJECTION]: The skill involves reading and auditing project configuration files like package.json and workflow YAMLs. While this constitutes a data ingestion surface, the audit checks are directed at structural patterns and configuration flags, which is normal behavior for a code auditing tool.

workleap-chromatic-best-practices