The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the Freshworks Developer Kit (FDK) for app validation (fdk validate) and simulation (fdk run). It also uses a suite of metadata utility scripts (meta-init.sh, meta-update.sh) stored in the local ~/.fw-dev-tools/ directory to manage skill session data. These are standard tools provided by the trusted vendor for this development environment.
[EXTERNAL_DOWNLOADS]: The instructions direct the user to install the Freshworks developer toolchain via npx @freshworks/fw-dev-tools and Claude plugins from the freshworks-developers organization. As these resources originate from the official vendor and well-known registries (npm), they are considered safe dependencies.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function involves processing external data sources such as third-party API documentation and integration requirements (CSV/Excel). The skill proactively addresses the associated injection risks by providing a template for server.js that includes a __sanitizeMessageForClient function, which redacts URLs and limits message length to prevent malicious payloads or data exfiltration from reaching the client.
[DYNAMIC_EXECUTION]: For SOAP-based integrations, the skill employs the strong-soap library. The documentation provides clear security guidance to mitigate common XML risks, explicitly instructing developers to disable external entity processing (XXE protection) and to use strict allowlisting for SOAP operation names.

fw-ai-actions-app