The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/ops.py script interacts with the 1Password CLI (op) to retrieve API tokens. This interaction is performed using safe subprocess calls with list-based arguments. The inputs for these commands (secret references) are sourced from a local configuration file that is restricted to the current user with mode 600 permissions.\n- [DATA_EXFILTRATION]: The skill performs authenticated HTTPS requests to well-known infrastructure providers including DigitalOcean, Laravel Forge, Laravel Cloud, and Openprovider. The implementation includes a robust redaction system that recursively scans API responses to remove sensitive information such as passwords, secret keys, environment variables, JWTs, and GitHub tokens before the data is shared with the agent.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external API providers, which represents a potential attack surface. The risk is mitigated by explicit instructions to avoid printing raw responses and the implementation of a comprehensive sanitization layer.\n
Ingestion points: API responses from DigitalOcean, Laravel Forge, Laravel Cloud, and Openprovider.\n
Boundary markers: Instructions provided in SKILL.md and authentication.md guide the agent to use specific fields and redact outputs rather than dumping raw data.\n
Capability inventory: Subprocess execution (1Password CLI), network operations (urllib.request), and local file writing (private output).\n
Sanitization: A recursive redact function in scripts/ops.py identifies and removes sensitive keys and values, including regex-based detection of common token formats.

spatie-ops