The Agent Skills Directory

[SAFE]: The skill provides high-quality documentation and examples for building developer platforms. It promotes secure defaults, such as recommending the use of environment variables for secrets management (e.g., ${GITHUB_TOKEN}, ${POSTGRES_PASSWORD}) rather than hardcoding credentials, and includes security-focused middleware like helmet in its Node.js templates.
[EXTERNAL_DOWNLOADS]: The implementation and installation guides (specifically in references/implementation-backstage.md) reference standard tools and packages from well-known and trusted sources. This includes the NPM registry for @backstage/create-app, the Bitnami Helm repository for database deployments, and various CNCF-graduated projects (Argo CD, Crossplane, Flux). These downloads are routine for established DevOps and platform engineering workflows.
[INDIRECT_PROMPT_INJECTION]: The software templates provided in the skill (e.g., examples/backstage/template-example.yaml and references/golden-paths.md) define project scaffolding that ingests user-defined parameters such as service name and description. These values are interpolated into configuration files like catalog-info.yaml and package.json. While this creates an input surface, the risk is typical for scaffolding tools and is addressed by the use of validation patterns (e.g., regex constraints on service names) to limit the character set of the injected data.

platform-engineering