The Agent Skills Directory

[SAFE]: The skill is entirely instructional and does not contain malicious code or commands. All examples are clearly labeled to distinguish between insecure and secure practices.- [COMMAND_EXECUTION]: Static analysis identified the use of dangerous functions like eval() and exec() in code snippets. These are used strictly as negative examples to illustrate remote code execution (RCE) vulnerabilities and are accompanied by explicit warnings (e.g., "Never do this") and secure alternatives.- [CREDENTIALS_UNSAFE]: The skill discusses secrets management and uses generic placeholders (like sk-XXXXXXXXXXXXXXXX) for illustrative purposes. It correctly advises against hardcoding secrets and recommends the use of environment variables and secrets managers.- [EXTERNAL_DOWNLOADS]: The skill references reputable security tools and libraries such as gitleaks, bcrypt, and bleach for educational purposes. No suspicious remote code downloads or execution patterns were detected.

secure-coding