The Agent Skills Directory

[SAFE]: The skill documents the integration of Assistant Cloud persistence and telemetry services. All identified network operations and data storage behaviors are consistent with the stated purpose of session management and application monitoring.\n- [EXTERNAL_DOWNLOADS]: The skill references several official Node.js packages, including @assistant-ui/react, @assistant-ui/ai-sdk, and assistant-cloud. These are vendor-owned resources from the author, assistant-ui, and are standard for this framework. It also includes integration examples for well-known authentication and database providers such as Clerk, Auth0, Supabase, Firebase, and Drizzle ORM.\n- [DATA_EXFILTRATION]: The skill includes a telemetry feature (cloud.runs.report) that sends run metadata (status, step count, tool calls, token usage) to the vendor's backend at assistant-api.com. This is a documented core feature, and the instructions provide a beforeReport hook for users to control or filter the metadata sent.\n- [CREDENTIALS_UNSAFE]: The documentation references the use of ASSISTANT_API_KEY and authToken. It correctly distinguishes between client-side and server-side usage, advising developers to keep the API key on the server and use short-lived tokens for the client. All examples in the documentation use generic placeholders for these credentials.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes message history and conversation metadata, creating an attack surface for indirect prompt injection where malicious instructions could be embedded in the persistent storage and subsequently loaded into the agent context.\n
Ingestion points: Thread and message history are loaded from the Assistant Cloud API as described in references/persistence.md and references/custom-persistence.md.\n
Boundary markers: The documentation mentions the use of specific message formats (e.g., ai-sdk/v6) but does not explicitly detail prompt boundary enforcement or sanitization for LLM-specific injection attacks.\n
Capability inventory: The skill performs network operations to the Assistant Cloud API for data persistence, file uploads, and telemetry reporting.\n
Sanitization: The skill uses defined encoding and decoding logic for message formats, but the documentation does not specify runtime sanitization of user-provided content to prevent instruction leakage.

cloud