The Agent Skills Directory

[DATA_EXPOSURE]: The skill implements strong security boundaries for sensitive data. It explicitly instructs the agent to treat .env files as protected secrets, use .env.example for documentation, and never print secrets to the output. It also utilizes a Vite proxy to prevent CORS issues without exposing the API key directly in client-side code where possible.
[COMMAND_EXECUTION]: Shell commands used (npm, curl, mv) are standard for project scaffolding and local environment setup. curl commands are specifically used for connectivity testing against the vendor's own API domain (api.datadoe.com).
[EXTERNAL_DOWNLOADS]: The skill references standard, well-known Node.js packages (@tanstack/react-table, dayjs, lucide-react) from official registries. While it specifies axios@1.13.6 (which may be a typo for 1.3.6 as 1.13.x is not a standard release), it targets a legitimate library.
[PROMPT_INJECTION]: The skill exhibits a standard indirect prompt injection surface common to data dashboards. It ingests untrusted data from an external API (DataDoe) such as product names and order statuses. However, the instructions favor standard React rendering which provides default XSS protection via JSX escaping. Capability is limited to browser-side display and localStorage.

create-orders-manager