The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Downloads public task data from https://api.taskmarket.dev/api/tasks?limit=100. This is a read-only operation targeting the primary service's API to populate task listings.
[COMMAND_EXECUTION]: Executes standard shell commands (curl, jq, node) to interact with the TaskMarket API. The usage is well-defined and scoped to the skill's purpose.
[CREDENTIALS_SAFE]: Properly manages sensitive credentials (TASKMARKET_API_KEY) by reading them from environment variables rather than hardcoding or passing them as CLI arguments. It explicitly instructs the agent not to leak these values.
[PROMPT_INJECTION]: Implements strong preventative measures by including a mandatory 'Authorization gate'. It requires explicit human operator confirmation before performing any 'write' operations (creating tasks or submitting work) and warns against using untrusted content to generate tasks.
[INDIRECT_PROMPT_INJECTION]: While the skill ingests external data (task descriptions), it mitigates risks by using structured parsing (jq/JSON) and limiting the output displayed to the agent. The risk is minimized by the mandatory authorization gate for all consequential actions.

taskmarket-delegate