The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill follows security best practices for secret management. Examination of templates like templates/basic-response.ts and templates/mcp-integration.ts confirms that API keys and OAuth tokens are retrieved via environment variables (process.env.OPENAI_API_KEY, process.env.STRIPE_OAUTH_TOKEN) rather than being hardcoded in the source code.
[EXTERNAL_DOWNLOADS]: All external resource references are directed toward official and trusted domains. This includes OpenAI's API endpoints (api.openai.com), official documentation pages (platform.openai.com), and Stripe's well-known Model Context Protocol (MCP) server (mcp.stripe.com). These references are necessary for the skill's primary educational purpose and pose no security risk.
[COMMAND_EXECUTION]: The utility script scripts/check-versions.sh performs local environment checks using standard system commands such as npm view and node -p to verify SDK version compatibility. The script's logic is transparent and focused solely on ensuring the development environment meets the skill's requirements.
[INDIRECT_PROMPT_INJECTION]: The skill provides templates for tools that process external data, such as web_search and file_search. While this creates a potential surface for indirect prompt injection, it is a standard feature of the Responses API. The skill correctly documents these tools as part of its agentic workflow templates, and the risk is assessed as safe within the context of developer education.
[SAFE]: The skill adheres to safe coding standards, provides high-quality documentation, and correctly configures its environment for secure API interactions.

openai-responses