The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs users to install a library from a GitHub repository hosted by an individual user account ('AlexanderCollins/TurboDRF') rather than an official organization or the stated author. This creates a risk of installing unverified or malicious forks.
[METADATA_POISONING]: There is a conflict between the registered skill author ('codeatcode') and the author name declared in the skill metadata ('mte90'). This inconsistency, combined with the external repository pointing to a third individual ('AlexanderCollins'), suggests deceptive metadata or potential impersonation.
[INDIRECT_PROMPT_INJECTION]: The skill facilitates the automatic generation of CRUD API endpoints that process untrusted external data.
Ingestion points: Data enters the system through generated REST endpoints (e.g., POST /api/books/) defined via the TurboDRFMixin and TurboDRFRouter.
Boundary markers: The framework provides a TURBODRF_SENSITIVE_FIELDS deny-list and "startup safety gates" to validate configuration, but these do not sanitize the content of processed data itself.
Capability inventory: The skill enables database read/write operations, complex query filtering, and custom model actions (turbodrf_action).
Sanitization: The skill mentions an optional full_clean: True setting to run model validation before saving data, which provides some protection but is not enabled by default.

turbodrf