The Agent Skills Directory

[SAFE]: The skill implements a secure architecture by routing all Data Marketplace API calls through a server-side Node.js proxy (server/proxy.mjs). This prevents sensitive credentials, such as the DATA_MARKETPLACE_API_KEY, from being exposed to the client-side browser environment.
[SAFE]: The included proxy server contains security controls to prevent directory traversal and unauthorized access to sensitive files. It specifically blocks access to dotfiles (e.g., .env) and its own source code, and validates that requested paths reside within the intended root directory.
[SAFE]: External dependencies are restricted to well-known and trusted services. The service loads the Pretendard font from jsDelivr and the Leaflet library from UNPKG, both of which are established and reputable CDNs.
[SAFE]: The instructions provided to the AI agent in SKILL.md explicitly enforce security guardrails, such as mandatory use of environment variables for secrets, prohibition of hardcoding keys, and guidance on sanitizing external data before rendering it in the UI.
[SAFE]: Input sanitization is addressed through the inclusion of a formatting module (assets/map-service/js/format.js) that provides HTML escaping functions used throughout the UI to mitigate potential cross-site scripting (XSS) risks from ingested real estate data.

data-marketplace-residential-service