The Agent Skills Directory

[SAFE]: The skill consists of documentation and code examples intended to guide developers in building legitimate integrations. No malicious patterns, obfuscation, or persistence mechanisms were detected.
[EXTERNAL_DOWNLOADS]: The examples reference standard Node.js packages such as @linear/sdk and fast-xml-parser. These are well-known, legitimate libraries used for the specific integration tasks described. The vendor-specific @factorialco/api-client is also correctly referenced as a platform dependency.
[CREDENTIALS_SAFE]: The code snippets demonstrate best practices for secret management by utilizing the platform's sensitive variable features (isSensitive: true and fcode.variables.set(..., { sensitive: true })) and avoiding hardcoded credentials. It includes specific patterns for reporting whether a credential is set without echoing the secret back to the user interface.
[INDIRECT_PROMPT_INJECTION]: The skill provides examples that ingest untrusted data via webhooks and file uploads. It explicitly documents defensive patterns to mitigate risks, such as payload validation, resolving user-supplied identifiers against internal records before execution (e.g., verifying recipient emails), and escaping data when generating output files (e.g., CSV cell escaping).
[COMMAND_EXECUTION]: The skill does not contain any shell command execution or unsafe system calls. It relies on standard high-level SDK methods and API interactions.

fcode-examples