The Agent Skills Directory

[SAFE]: The skill provides defensive programming guidelines and security best practices for CLI development.\n- [CREDENTIALS_UNSAFE]: The documentation explicitly forbids accepting secrets through CLI flags and recommends the OS keyring for API key storage, which prevents accidental credential leakage in shell history or process logs.\n- [COMMAND_EXECUTION]: The skill documents the implementation of a run command that executes child processes; however, it prescribes using controlled Effect-based services like effect/process and ChildProcessSpawner instead of raw Node.js modules to manage process lifecycle and security boundaries.\n- [INDIRECT_PROMPT_INJECTION]: The skill identifies surfaces for untrusted data ingestion, such as stdin and file-based inputs (@file), and provides a mitigation strategy by requiring commands to validate all supplied data with dedicated parsers and schemas before processing.

cli-command