The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides several shell command examples intended for development and administrative tasks. These include a loop to trigger file watchers for plugin reloading, testing utilities using tmux for terminal UI validation, and a diagnostic grep command designed to find and remove hardcoded secrets or personal paths before public distribution. These are all documented as developer tools and follow the stated purpose of the skill.
[EXTERNAL_DOWNLOADS]: The instructions refer to well-known technology services and providers, such as Google Workspace (for Gmail/Calendar integration), OpenRouter, Groq, and DeepSeek. These references are part of the guidance for implementing external model routing and prefetch capabilities, with specific instructions on how to handle authentication and timeouts safely.
[CREDENTIALS_UNSAFE]: The skill demonstrates high security awareness regarding credentials. It explicitly instructs developers to avoid hardcoding secrets, use environment variables (.env), redact sensitive values from logs, and implement least-privilege OAuth scopes (e.g., gmail.readonly). It also includes a dedicated sanitization checklist for public repository preparation.
[REMOTE_CODE_EXECUTION]: While the skill discusses building plugins that can execute code (e.g., tool routing and prefetch logic), it focuses on doing so through secure contracts. It details the use of 'fail-closed' policies, atomic deployment strategies, and isolated testing environments to prevent unauthorized or unintended execution.
[DATA_EXFILTRATION]: The skill includes defensive measures against data exfiltration. It defines 'privacy-safe' logging, egress disclosure requirements for public plugins, and techniques for bounding prefetch results to metadata/snippets to minimize the exposure of sensitive user data to external models.

hermes-plugin-development