The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill performs integrity and version verification by fetching metadata and file content from the official adaptavist repository on GitHub (api.github.com and raw.githubusercontent.com). These operations are used solely to ensure the agent is using the most current and untampered version of the skill.
[COMMAND_EXECUTION]: The agent is instructed to use the @sr-connect/cli tool to perform its tasks. The instructions emphasize the use of the --agent and --raw flags to ensure predictable, structured interaction between the agent and the CLI utility.
[CREDENTIALS_UNSAFE]: The skill follows excellent security posture by explicitly forbidding the passing of credentials in command-line arguments (argv). Instead, it mandates using auth login --credentials-stdin or environment variables, preventing secrets from appearing in process lists or shell history.
[DATA_EXPOSURE]: There is a clear policy against reading environment parameter values (which may contain secrets) without explicit, one-time permission from the user. The agent is directed to use the generated ev-params.ts file for development, which contains types and descriptions but no actual values.
[INDIRECT_PROMPT_INJECTION]: The documentation recognizes the potential for malicious data ingestion through event listeners. It provide detailed 'Hardening' guidance, instructing users and agents to implement shared-secret header verification and source IP allowlisting within the scripts to ensure only authorized requests are processed.

sr-connect