The Agent Skills Directory

[SAFE]: The skill uses official vendor-owned resources for its primary functionality. The @datocms/cda-client package and the https://graphql.datocms.com/ endpoint are legitimate components of the DatoCMS infrastructure.
[SAFE]: The skill follows security best practices for secret management by instructing the agent to search for API tokens in environment variables (.env files) rather than requesting them directly or suggesting hardcoded values.
[EXTERNAL_DOWNLOADS]: The skill suggests installing several standard development packages (gql.tada, graphql-codegen, dotenv-cli) which are well-known in the industry and used for their intended purposes (type safety and environment management).
[INDIRECT_PROMPT_INJECTION]: While the skill ingests external data from a GraphQL API, it treats the data as content to be structured and rendered rather than instructions to be executed. The instructions focus on proper handling of the DatoCMS Abstract Syntax Tree (DAST) and modular content, minimizing the risk of accidental instruction following from untrusted content.

datocms-cda