The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes a bash script (keys-broker.sh) to interface with system utilities including curl, jq, and OS-specific keychain tools (security on macOS, secret-tool on Linux). This execution is limited to the tool's intended administrative and proxying functions.
[EXTERNAL_DOWNLOADS]: The broker facilitates network requests to well-known, trusted API endpoints such as OpenAI, Anthropic, Stripe, and GitHub. These connections are strictly governed by an internal allowlist within the script to prevent data exfiltration to unauthorized domains.
[PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it processes data returned from external APIs.
Ingestion points: keys-broker.sh captures external API response bodies.
Boundary markers: Absent; the agent receives the JSON response data without explicit delimiters or instructions to ignore embedded content.
Capability inventory: The agent has access to file system operations and subprocess execution.
Sanitization: Absent; the script ensures JSON structure integrity via jq but does not sanitize the content of the response for potential instructions.
[SAFE]: The architecture demonstrates a security-first design by implementing a broker pattern that decouples credential retrieval from the agent's observation space. It employs best practices such as OS-level keychain integration, temporary file handling for sensitive headers with restricted permissions (chmod 600), and strict regex-based URL validation.

Keys