The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill identifies the risk of processing untrusted web request data through ingestion points such as req.body, req.params, and req.query in SKILL.md. It mitigates this by mandating the use of schema validation libraries like Zod (safeParse) as a sanitization step. While the skill possesses capabilities to interact with a database via Prisma, the instructions emphasize using boundary markers and validation to prevent injection attacks.
[COMMAND_EXECUTION]: The documentation includes standard commands for Node.js application lifecycles, such as npm ci for clean dependency installation and npx prisma migrate deploy for database migrations. These are benign and standard for the described development and deployment use cases.
[CREDENTIALS_UNSAFE]: The instructions contain a strong directive for the agent to never invent or request production database connection strings or API keys, emphasizing the use of environment variables for secret management.
[DATA_EXFILTRATION]: The skill addresses potential IP spoofing by providing detailed guidance on the trust proxy setting, recommending the use of specific hop counts or subnet lists rather than insecure global flags to ensure the integrity of client-related metadata.

express