The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data such as email addresses, passwords, and IP addresses within its security logic.
Ingestion points: Data enters the context via parameters in the checkLoginRateLimit, hashPassword, and verifyTOTP functions in SKILL.md.
Boundary markers: Explicit delimiters for user-supplied strings are absent in the code snippets, which is standard for utility functions.
Capability inventory: The skill utilizes network capabilities for Redis-backed rate limiting (@upstash/redis) and mentions fetching data from the HaveIBeenPwned API for breach detection.
Sanitization: The skill explicitly instructs developers to normalize email addresses (lowercase and stripping aliases) to prevent rate-limit bypasses.
[EXTERNAL_DOWNLOADS]: The skill references several well-known and reputable third-party security plugins for WordPress (Wordfence, WP 2FA, Nextend Social Login) and established Node.js libraries (argon2, otplib, jose). These are standard industry tools for the stated purpose of account security.
[DATA_EXPOSURE]: The skill promotes secure credential management by instructing the use of environment variables for Redis configuration (Redis.fromEnv()) and explicitly warns against storing sensitive tokens in localStorage, recommending httpOnly cookies instead.

account-security