The Agent Skills Directory

[SAFE]: The skill provides instructional content for packaging desktop applications. It emphasizes security best practices, such as using environment variables for sensitive keys and certificates.
[EXTERNAL_DOWNLOADS]: The CI/CD examples (examples/ci-cd.md) reference official and well-known GitHub Actions including tauri-apps/tauri-action, actions/checkout, actions/setup-node, and dtolnay/rust-toolchain. These are standard, trusted resources for the described development workflow.
[CREDENTIALS_UNSAFE]: No hardcoded credentials were found. The skill uses descriptive placeholders like YOUR_ED25519_PUBLIC_KEY, YOUR_THUMBPRINT, and APPLE_CERTIFICATE: <base64-encoded .p12 file>. It explicitly warns users NEVER to commit private keys to source control, recommending CI secrets instead.
[INDIRECT_PROMPT_INJECTION]: The skill documents the ingestion of configuration data (e.g., tauri.conf.json). While this is a common vector for indirect injection, the skill mitigates risk by enforcing mandatory signature verification (Ed25519) for the auto-updater and providing clear boundary instructions for developers.
[COMMAND_EXECUTION]: The skill illustrates the use of Tauri's signCommand and sidecar features for executing external binaries. The examples provided (e.g., trusted-signing-cli, ffmpeg) are legitimate use cases for the framework, and the documentation highlights the necessary permissions and configuration required for safe execution.

desktop-packaging-tauri