The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user data within the state field of generated requests. It mitigates potential injection attacks by providing clear instructions for the agent to treat this field as passive data rather than executable commands. The skill also recommends using boundary markers (such as backticks for JSON paths) and specific injection-detection questions to sanitize the input. (Mandatory Evidence Chain: Ingestion points in SKILL.md mode procedures; Boundary markers recommended in references/question-design.md; Capabilities include network calls in generated code templates; Sanitization includes recommended injection-detection questions in rules/safety-and-boundaries.md).
[CREDENTIALS_SAFE]: The skill implements robust credential hygiene, explicitly forbidding the hardcoding, logging, or storage of API keys. It utilizes placeholders and environment variables in its code templates and provides safe procedures for checking the presence of keys without revealing their values.
[COMMAND_EXECUTION]: The skill includes a local validation script (scripts/check-jev-request.mjs) used to verify the structure and safety of generated JSON artifacts offline. This script runs in the bun environment and is limited to deterministic data validation without performing high-risk system operations or executing remote code.

jev-maker