The Agent Skills Directory

[Secure Credential Handling]: The skill explicitly prohibits requesting or handling passwords. It mandates the use of OAuth or tokens, which are to be entered directly into the platform's storage rather than the conversation transcript.
[Approval Gates for Write Actions]: Any action that modifies data (writes) requires a mandatory approval gate, regardless of the user's initial request. This prevents unintended or destructive changes to the owner's systems of record.
[Least Privilege Principles]: The instructions emphasize requesting the narrowest possible scope (read-only by default) and using dedicated integration users rather than personal logins to ensure access can be revoked without disruption.
[Avoidance of Custom Code]: The skill discourages hand-building against raw REST APIs, preferring maintained connectors (MCP/Zapier). This reduces the risk of unmaintained, insecure code and potential vulnerabilities arising from custom authentication plumbing.
[Sanitization of External Content]: It includes explicit instructions to treat all text from tool results or documents as untrusted data, specifically flagging bank detail changes or credential requests for human verification.

build-connector