The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/verify-github-project.sh script performs an automated audit of a repository's settings by executing gh api and git commands. It checks for the existence of required documentation, dependency management configurations, and branch protection settings.
[INDIRECT_PROMPT_INJECTION]: The skill includes several GitHub Action templates (e.g., release-labeler.yml.template, auto-merge.yml.template) that process data from pull requests and releases. The templates demonstrate security awareness by using printf and temporary files to handle untrusted input, mitigating potential shell injection risks from release bodies or PR titles.
[EXTERNAL_DOWNLOADS]: The references/actionlint-guide.md file provides instructions for installing actionlint using curl from its official GitHub releases. This is a standard installation procedure for a well-known development tool.
[COMMAND_EXECUTION]: Workflow templates such as assets/pr-quality.yml.template use gh pr review --approve to automate approvals for trusted collaborators. The documentation explicitly warns against using actions/checkout within pull_request_target workflows to prevent unauthorized code execution with write permissions.

github-project