The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/agent.py executes the cosign utility to verify container image signatures. The execution is handled through structured argument lists, which prevents shell-based command injection vulnerabilities.
[COMMAND_EXECUTION]: The script scripts/process.py invokes gpg and cosign to sign and verify files. It correctly handles process output and return codes to ensure the integrity of the signing pipeline.
[SAFE]: The skill uses well-known cryptographic libraries and follows standard procedures for artifact integrity. No indicators of data exfiltration or malicious intent were found in the provided files.

implementing-code-signing-for-artifacts