The Agent Skills Directory

[SAFE]: The skill consistently promotes secure development practices. It explicitly instructs the agent to refuse requests that violate security protocols, such as committing master keys or bypassing input validation.
[CREDENTIALS_SAFE]: Instructions correctly handle Rails secrets by advocating for the use of the RAILS_MASTER_KEY environment variable and encrypted credentials, while strictly prohibiting the hardcoding or exposure of plaintext secrets.
[COMMAND_EXECUTION]: The skill includes standard Rails CLI commands (e.g., bin/rails db:migrate, bin/rails assets:precompile) and deployment scripts that are necessary for its stated purpose. These operations are conducted using local project binaries without any remote or suspicious execution patterns.
[INDIRECT_PROMPT_INJECTION]: The skill defines an attack surface by processing untrusted user data via HTTP parameters, but it provides comprehensive mitigations.
Ingestion points: Untrusted data enters the application through params in app/controllers/items_controller.rb.
Boundary markers: None (typical for web application input handling).
Capability inventory: The skill uses database write capabilities through Active Record (item.save) and subprocess execution via local development binaries (bin/rails).
Sanitization: The skill mandates the use of strong parameters (params.require(...).permit(...)) and recommends parameter filtering (config.filter_parameters) to prevent unauthorized data exposure or manipulation.

rails