The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The Node.js reference implementation in references/nodejsexpress-jwt-implementation.md includes a hardcoded fallback secret ("dev-secret") for the JWT_SECRET environment variable. While explicitly intended for development contexts, hardcoding fallback values for cryptographic secrets is a practice that can lead to vulnerabilities if accidentally deployed to production.
[INDIRECT_PROMPT_INJECTION]: The shell script scripts/security-checklist.sh accepts a user-provided file path as an argument to write its output, which creates a vulnerability surface for writing to unintended locations.
Ingestion points: The first command-line argument ($1) in scripts/security-checklist.sh used to define the OUTPUT variable.
Boundary markers: Absent; the script does not use delimiters to isolate the input path from the shell command execution.
Capability inventory: The script performs a file write operation using cat > "$OUTPUT" and utilizes the set -euo pipefail shell option.
Sanitization: Absent; there is no validation or sanitization of the provided file path, which could allow path traversal or overwriting of sensitive system files if the script is executed with high privileges.
[COMMAND_EXECUTION]: The skill includes an executable shell script scripts/security-checklist.sh designed to generate markdown documentation via terminal commands.

session-management