The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill involves processing external data such as SSO tickets and redirect URLs. However, it incorporates security best practices by recommending the use of communication signing and secret keys to protect these parameters from manipulation.
Ingestion points: The ssoRequest and loginByTicket methods in examples/sso-demo.md and references/sso-h5.md process URL parameters like ticket and redirect.
Boundary markers: The skill highlights the need for secret-key and is-check-sign: true in production environments to validate incoming data.
Capability inventory: Capabilities are limited to standard authentication processing via the Sa-Token SDK (SaSsoServerProcessor, SaSsoClientProcessor).
Sanitization: The skill instructs developers to use built-in SDK methods for ticket checking, which includes signature validation.
[EXTERNAL_DOWNLOADS]: The skill contains numerous references to official documentation and source code hosted on GitHub under the dromara organization. These are used for instructional purposes and point to the legitimate project repository.
[CREDENTIALS_UNSAFE]: While the skill mentions secret-key, it uses clear placeholders like mySecretKey or xxxx in examples, following safe practice by instructing users to configure their own keys in .env or configuration files.

sa-token-sso