The Agent Skills Directory

[SAFE]: The skill provides structural and procedural instructions for developers working on the OpenBot codebase. It outlines a standardized architecture using a centralized client.ts for all network requests, which is a security best practice to ensure consistent header management, credential handling, and error processing.
[CREDENTIALS_UNSAFE]: The skill explicitly advises against exposing sensitive data. Procedure 1, Step 4 states: 'Never put a secret's value in a read type. A credential is hasAuth: boolean or a revokedAt timestamp. Secrets are write-only in this codebase.' This demonstrates a proactive security posture regarding credential management.
[DATA_EXFILTRATION]: The skill defines a strict policy where all browser-to-server communication must go through a single, audited transport layer (app/src/lib/client.ts). By forbidding the use of fetch() inside React components and requiring centralized factories, it reduces the surface area for unauthorized or hidden data exfiltration.
[INDIRECT_PROMPT_INJECTION]: While the skill mentions processing data from the 'CopilotKit runtime', it delegates the handling of that specific stream to a different domain, focusing here on standard API requests. It emphasizes using server-provided authorization flags (canManage, mine) rather than recomputing permissions in the browser, which helps maintain a secure trust boundary.

openbot-data-access