The Agent Skills Directory

[SAFE]: The project structure promotes secure design by separating model-owned semantic logic from host-owned deterministic validation. Input data from users is strictly processed through YAML-defined prompts with rigid JSON output schemas.
[SAFE]: Sensitive information is managed securely. The SETTINGS.yaml template utilizes environment variable interpolation (e.g., ${ENV.DEEPSEEK_API_KEY}) to avoid hardcoding secrets within the codebase.
[SAFE]: The skill implements data exposure protections. The trace_log.py utility includes a bounded function that restricts the depth and size of objects being logged, and the services/contracts.py module explicitly projects only approved public fields to prevent internal metadata leakage.
[COMMAND_EXECUTION]: The framework facilitates the execution of local scripts as actions (e.g., calculate_growth.py). This is handled via standard input/output streams within a controlled environment, and documentation emphasizes pinning trusted script revisions with cryptographic digests.
[PROMPT_INJECTION]: The skill handles untrusted user input (business questions) but mitigates injection risks by instructing the model to adhere strictly to provided evidence and validating all model-returned keys (such as metric names) against an authoritative host-side catalog before further processing.

agently