The Agent Skills Directory

[SAFE]: The skill leverages the official @caido/sdk-client for all API interactions, ensuring compatible and standard communication with the backend service.
[SAFE]: Authentication secrets and Personal Access Tokens (PATs) are managed according to platform guidelines, being stored securely in ~/.claude/config/secrets.json with multi-instance support to prevent credential clobbering.
[SAFE]: Generated shell commands (e.g., for curl) utilize robust shell quoting via the shQuote function to mitigate command injection risks when handling request data.
[SAFE]: Configuration file generation for curl -K implements appropriate escaping (stripping newlines and escaping double-quotes) to prevent directive injection within the config files.
[INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted HTTP history data fetched from the external Caido instance. This is a known surface for indirect prompt injection (Category 8), but the risk is assessed as low as the skill does not autonomously execute the content and relies on standard agent safety guardrails during analysis.

caido-mode