The Agent Skills Directory

[SAFE]: The skill interacts exclusively with legitimate Yandex Cloud endpoints (searchapi.api.cloud.yandex.net and iam.api.cloud.yandex.net) and well-known Yandex services for keyword statistics. All external documentation links are verified official resources.
[SAFE]: Authentication is handled securely using either IAM tokens or API keys. The internal scripts implement a robust token exchange process using OpenSSL and umask 077 to protect temporary private key material and cached credentials, ensuring they are only accessible to the current user. Documentation guides users to secure their .env files and uses .gitignore to prevent secret exposure.
[COMMAND_EXECUTION]: The skill uses local shell and Python scripts for data processing and API interaction. These executions are legitimate, scoped to the skill's functional requirements, and do not involve insecure patterns such as executing unverified remote code.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted search data from user-provided XLSX files via the missed_demand.py script. This ingestion surface is well-guarded by specific sanitization logic that filters punctuation and syntax operators, treating the input strictly as data for keyword segmentation rather than instruction context.

yandex-wordstat