The Agent Skills Directory

[CREDENTIALS_SAFE]: The skill implements strong secret management practices. It explicitly instructs the agent and user to use a local, Git-ignored .env file and to avoid echoing credentials in chat, command arguments, or tool outputs. It specifically recommends chmod 600 for file permissions.
[EXTERNAL_DOWNLOADS]: The skill installs Python dependencies (arize, arize-phoenix-client, httpx, python-dotenv) from standard registries. These are official SDKs and utilities for the services involved.
[COMMAND_EXECUTION]: The skill executes a bundled Python script (scripts/migrate.py) to perform the migration. The execution is scoped to the skill's own logic and uses absolute paths to ensure it targets the intended files.
[DATA_EXFILTRATION]: While the skill performs network operations to Phoenix and Arize AX endpoints, this is the primary and stated purpose of the skill (migration). The script uses the official Arize SDK and standard HTTPS requests to the vendor's own infrastructure (arize-ai.com and related domains). It includes redaction logic in progress reports to ensure no trace payloads or keys are leaked to the agent's logs.
[INDIRECT_PROMPT_INJECTION]: The skill processes external trace data. It mitigates injection risks by treating trace attributes as data (storing them in structured formats like JSON or Arrow/DataFrames) rather than interpreting them as instructions. The verification step further ensures data integrity.

arize-phoenix-migration