The Agent Skills Directory

[DATA_EXFILTRATION]: The skill implements a comprehensive secret-masking mechanism (via the redact function and keep_secret registry) to ensure that sensitive OAuth tokens never appear in process logs or the agent's dialogue. It also maintains a blacklist of forbidden keys (e.g., password, secret, token) to prevent sensitive metadata from being stored in the local cache.
[COMMAND_EXECUTION]: All executable scripts are written in standard Python, utilizing the standard library for logic and data processing. There is no usage of subprocess, os.system, or other dynamic execution sinks that could be exploited for arbitrary command execution.
[OBFUSCATION]: Analysis confirmed that no malicious obfuscation techniques (such as hidden payloads or homoglyph-based URL spoofing) are used. Base64 encoding is utilized only for legitimate data serialization required by the Yandex API, such as uploading binary image data or XML-based ad feeds.
[SAFE]: The skill follows security best practices by utilizing local .env files for configuration and implementing file-system-level guards in its cache layer to prevent directory traversal and symbolic link manipulation.

yandex-direct