The Agent Skills Directory

[SAFE]: The skill is purely instructional, focusing on API and event schema evolution between consumers and providers. It does not contain any executable malicious code or dangerous instructions.
[PROMPT_INJECTION]: No attempts to override agent behavior or bypass safety guidelines were detected. The content focuses on development workflows.
[INDIRECT_PROMPT_INJECTION]: The skill proactively addresses this risk by instructing the agent to treat contract content (OpenAPI, etc.) strictly as data and never as instructions. It also recommends rejecting path traversal and unauthorized remote references when resolving schema components.
[COMMAND_EXECUTION]: While the skill mentions running generators (e.g., npm run generate:api-types), it explicitly advises running these with least privilege, no network access, and restricted file system writes, which is a security best practice.
[DATA_EXPOSURE]: No hardcoded credentials, sensitive file paths, or exfiltration patterns were identified.

contract-first