The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The documentation files references/api-sign.md and references/temp-token.md include hardcoded dummy secret keys used to illustrate configuration examples. While these are intended for demonstration, they follow patterns associated with hardcoded credentials. The skill documentation provides explicit warnings against hardcoding these values in production.
[INDIRECT_PROMPT_INJECTION]: The skill defines logic for processing external input via API parameters and tokens in its examples, which creates an attack surface where malicious data could potentially influence agent behavior.
Ingestion points: Request parameters in ApiController and token strings in TempTokenController found in examples/api-security-demo.md and examples/temp-token-scenarios.md.
Boundary markers: The provided code examples do not demonstrate the use of delimiters or specific instructions to the agent to ignore content within the processed data.
Capability inventory: The skill utilizes framework-specific utility classes to perform security checks and parse data.
Sanitization: The implementation relies on the internal validation mechanisms of the Sa-Token library, such as signature verification and token parsing logic.
[EXTERNAL_DOWNLOADS]: The evaluation-report.html file includes a reference to the Tailwind CSS CDN at https://cdn.tailwindcss.com. This is a standard reference to a well-known service used for providing CSS utilities for the report presentation.

sa-token-api-security