The Agent Skills Directory

[SAFE]: The skill's primary function is to wrap the official USDA FoodData Central API (api.nal.usda.gov). All network operations target this well-known government domain.
[COMMAND_EXECUTION]: Static analysis identified subprocess and shell execution patterns in the scripts/ directory. These were found to be benign wrappers that use subprocess.run (Python) and spawnSync (Node.js) to execute the local run_api execution engine with specific arguments for each API endpoint. This is a standard architectural pattern for this type of generated skill.
[CREDENTIALS_UNSAFE]: The skill uses the DEEPNLP_ONEKEY_ROUTER_ACCESS environment variable for authentication, which is a recommended security practice. While the metadata files (api_list.json) contain value_encode fields with Base64-encoded strings, these appear to be non-sensitive encrypted routing tokens used by the platform's API gateway rather than plain-text secrets.
[PROMPT_INJECTION]: The skill instructions in SKILL.md are purely technical documentation for the API and do not contain any instructions that attempt to override or bypass agent safety guidelines.

fdcnal-usda-fooddata-central-agent