The Agent Skills Directory

[SAFE]: The skill documents the use of the @bitrix24/b24jssdk library, which is an official resource from the vendor bitrix24.
[SAFE]: It provides defensive security guidance, such as a checklist that instructs developers to verify application tokens for outbound webhooks and uninstall events to prevent replay attacks and unauthorized data deletion.
[SAFE]: The instructions encourage best practices for secret management, recommending that webhook secrets be stored in environment variables (process.env.B24_HOOK) rather than being hardcoded in application logic.
[SAFE]: It documents the SDK's built-in security features, such as the automatic redaction of sensitive parameters (passwords, tokens, secrets) from error logs to prevent credential leakage.
[SAFE]: The skill addresses the handling of untrusted data from external sources with appropriate safety recommendations. Ingestion points: Data received via B24Frame (postMessage), B24OAuth events, and webhook payloads. Boundary markers: Guidance on comparing application_token against trusted environment variables. Capability inventory: SDK provides methods for making authenticated REST API calls. Sanitization: Instructions to HTML-escape user input before transmission to chat or messaging interfaces.

b24jssdk-core