The Agent Skills Directory

[SAFE]: The skill provides high-quality documentation for implementing OAuth 2.0 and OpenID Connect in Tauri applications, emphasizing the use of the Authorization Code flow with PKCE (Proof Key for Code Exchange) to protect tokens.
[SAFE]: Strong emphasis is placed on security best practices for authentication, including mandatory state and nonce validation, the use of cryptographically secure random values, and short TTLs for authentication state to prevent CSRF and replay attacks.
[SAFE]: The skill offers specific guidance for managing sensitive assets such as Android keystores, iOS distribution certificates, and App Store Connect API keys, correctly advising the use of .gitignore and secure environment variables in CI/CD pipelines.
[SAFE]: Technical solutions for common Tauri build issues (e.g., stale frontend assets in Android APKs or cross-compilation blockers on Windows) are provided as architectural improvements (e.g., custom build.rs walk patterns) rather than unsafe workarounds.
[INDIRECT_PROMPT_INJECTION]: The skill describes patterns for ingesting external data via OAuth callbacks and deep links. While it provides robust validation logic for these inputs, these components represent the primary entry points for untrusted data in applications built with these instructions.
[SAFE]: The skill contains a Base64-encoded string (dW50cnVzdGVkIGNvbW1lbnQ...) in the auto-updater reference, which decodes to the standard 'untrusted comment' header used by Minisign, the underlying signing tool for Tauri's update system.

tauri