The Agent Skills Directory

[CREDENTIALS_SAFE]: The skill emphasizes secure API key management, instructing developers to use environment variables and never expose keys in client-side code or logs. It explicitly warns against typosquatted packages on public registries.
[COMMAND_EXECUTION]: Provides example scripts for API interaction. These scripts include security checks (e.g., checked_api_url and host validation) that restrict where the API key can be sent, preventing accidental exfiltration to untrusted domains.
[EXTERNAL_DOWNLOADS]: Mentions the official deAPI Python SDK hosted on GitHub. This is a vendor-controlled resource, and the instructions recommend using a pinned version (@v0.5.2) for stability and security.
[INDIRECT_PROMPT_INJECTION]: Includes a specific rule advising the agent to treat data returned from the API (like transcripts or OCR) as data only and never as instructions, effectively mitigating potential injection risks from external media content.
[DATA_EXFILTRATION]: Webhook verification examples implement standard HMAC-SHA256 signatures, constant-time comparisons, and replay protection windows (5 minutes), following security best practices for handling external callbacks.

deapi-api