Review workflow changes with least privilege. Fork pull requests must not receive secrets or write tokens. Pin actions to intentional major versions, avoid runtime package downloads where workspace-pi
Free account. Installing gives you the manifest plus copy-paste snippets.
See reviewsInstruction file imported from fuf-stack/pixels (
.github/instructions/workflows.instructions.md). Copyright stays with the author.
Review workflow changes with least privilege. Fork pull requests must not receive
secrets or write tokens. Pin actions to intentional major versions, avoid runtime
package downloads where workspace-pinned tools exist, preserve trusted npm
publishing through OIDC, and ensure untrusted pull-request code cannot reach a
privileged pull_request_target context.
Copy one of these into your project. Installing also returns the manifest and these snippets.
targets:
- https://api.opensmartroute.ai/api/v1/registry/fuf-stack-pixels-workflows-instructions/manifest # or paste the manifest belowAn Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.
{
"ocm": "1",
"id": "fuf-stack-pixels-workflows-instructions",
"kind": "skill",
"name": "workflows",
"description": "Review workflow changes with least privilege. Fork pull requests must not receive secrets or write tokens. Pin actions to intentional major versions, avoid runtime package downloads where workspace-pinned tools exist, preserve trusted npm publishing through OIDC, and ensure untrusted pull-request code cannot reach a privileged `pull_request_target` context.",
"publisher": "fuf-stack",
"version": "1.0.0",
"capabilities": {
"domains": [
"coding"
],
"tags": [
"skill-md",
"github-instructions"
],
"languages": [
"en"
]
},
"quality_prior": 0.6,
"examples": [
"Review workflow changes with least privilege. Fork pull requests must not receive secrets or write tokens. Pin actions to intentional major versions, avoid runtime package downloads where workspace-pinned tools exist, preserve trusted npm publishing through OIDC, and ensure untrusted pull-request code cannot reach a privileged `pull_request_target` context."
],
"primary": false,
"metadata": {
"source": {
"provider": "github-instructions",
"repository": "https://github.com/fuf-stack/pixels",
"path": ".github/instructions/workflows.instructions.md",
"ref": "1e2cc3b0c92649999f5347a7ca44c5414a3ea8eb",
"url": "https://github.com/fuf-stack/pixels/blob/1e2cc3b0c92649999f5347a7ca44c5414a3ea8eb/.github/instructions/workflows.instructions.md",
"key": "fuf-stack/pixels/.github/instructions/workflows.instructions.md"
},
"applies_to": ".github/**/*.{yml,yaml}"
},
"instructions": "Review workflow changes with least privilege. Fork pull requests must not receive\nsecrets or write tokens. Pin actions to intentional major versions, avoid runtime\npackage downloads where workspace-pinned tools exist, preserve trusted npm\npublishing through OIDC, and ensure untrusted pull-request code cannot reach a\nprivileged `pull_request_target` context.",
"cost": {
"context_tokens": 89
}
}Fetch it by URL: GET /api/v1/registry/fuf-stack-pixels-workflows-instructions/manifest?version=1.0.0
Star ratings from people who tried it. One review per account; edit yours any time.
No reviews yet. Install it, try it, and be the first to rate it.