The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill's reference templates include dependencies on well-known, official GitHub Actions and container images for building, scanning, and deploying software. Examples include aquasecurity/trivy-action, semgrep/semgrep-action, aws-actions/configure-aws-credentials, and official Docker images like postgres:16.
[CREDENTIALS_UNSAFE]: Templates utilize secure secret management practices, specifically using environment variables for webhooks and AWS OIDC for identity-based access to cloud resources. A hardcoded password (test) is used in a test configuration for a local Postgres container, which is standard practice for isolated CI testing environments.
[TIME_DELAYED_CONDITIONAL]: A Python script is provided to implement 'deployment freeze' windows. This is a transparent administrative control used to prevent production changes during high-risk periods like holidays.
[INDIRECT_PROMPT_INJECTION]: The skill has an ingestion surface for application metadata used to generate pipeline designs. While the skill documentation provides guidance on security gates and scanning, users should remain aware that the integrity of the generated pipeline depends on the safety of the source code and configuration it processes.
[COMMAND_EXECUTION]: The skill provides scripts for deployment verification and Slack notifications. These use standard shell commands and do not involve executing untrusted input or remote code from unknown sources.

deployment-pipeline-design