The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches a helper script (confident_onboard.py) from the vendor's official GitHub repository (github.com/confident-ai/confident-skills).
[COMMAND_EXECUTION]: Executes the Python helper script to manage authentication and project configuration. It also uses standard Git commands (git status, git check-ignore) to verify the repository state and ensure secret files are correctly ignored.
[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest and analyze the user's project codebase to configure tracing and issue detection labels.
Ingestion points: The agent reads project documentation (README, package manifests) and source code files (scripts, application entry points) as specified in SKILL.md and references/instrument.md.
Boundary markers: The instructions provide clear safety rules, such as "Never read the key" and "Never paste the key... into code, commands, logs, or chat," which act as functional boundaries against credential exposure.
Capability inventory: The skill's helper script can write to the filesystem (.env.local), perform network requests to vendor API and OTel endpoints (api.confident-ai.com, otel.confident-ai.com), and execute subprocess calls to git.
Sanitization: The helper script uses standard JSON serialization for all data transmitted to the vendor's APIs, minimizing the risk of injection during data transfer.
[SAFE]: The skill implements robust security practices, including setting file permissions to owner-only (0600) when writing credentials and providing explicit instructions to avoid accidental leakage of sensitive information in the agent's conversation history.

confident-onboard