The Agent Skills Directory

[SAFE]: The skill provides detailed guidance on building secure AI applications. It includes explicit warnings and recipes for preventing prompt injection, path traversal, and data exfiltration in AI agent workflows. Diagnostic tools such as build-report-lite.mjs and runner-scaffold.mjs implement strict security checks, including refusing to follow symlinks or hard links to prevent unauthorized file access.
[PROMPT_INJECTION]: While static analysis flagged communication instructions in shared/evals/build-eval.md as concealment, these are benign UX guidelines intended to manage output verbosity during evaluation processes. The skill actually provides extensive countermeasures against prompt injection for developers, such as advice on using delimiters and avoid re-injecting untrusted content into system prompts.
[DATA_EXFILTRATION]: All network operations in the provided scripts target whitelisted or well-known Anthropic domains (e.g., api.anthropic.com) for verification and telemetry purposes. Credentials are handled securely using environment variables and interactive shell input methods (read -rs), ensuring they are not exposed in command history or project files.
[REMOTE_CODE_EXECUTION]: Installation commands and dependencies point to official, trusted repositories from established vendors like Anthropic. The provided runner scaffolds are skeletons designed for localized testing and include integrity gates (hashing) to detect and prevent the execution of unauthorized modifications.
[OBFUSCATION]: Diagnostic and reporting scripts use standard character escaping for terminal output and HTML generation to prevent injection attacks; no malicious obfuscation or homoglyph-based URL spoofing was detected.
[INDIRECT_PROMPT_INJECTION]: The skill's reporting tools implement strict Content Security Policies (CSP) and comprehensive data escaping to ensure that analyzed content (such as conversation transcripts) remains inert and cannot execute malicious code in the user's browser environment.

claude-api