The Agent Skills Directory

[SAFE]: The skill is purely instructional and does not contain any executable code, scripts, or binary files. It defines a workflow for using a list_projects tool to discover existing resources within a specific service context.
[SAFE]: The instructions explicitly implement a 'read-before-write' policy and restrict the agent to discovery and inspection tasks. It specifically instructs the agent not to create, modify, or delete resources, directing such tasks to other specialized skills if needed, which minimizes the risk of accidental or unauthorized state changes.
[SAFE]: No obfuscation, direct prompt injection, or data exfiltration patterns were detected across the skill files. The documentation provides clear error recovery paths and validation checklists to ensure operational integrity.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it ingests project metadata (such as titles and resource IDs) from external tool outputs. However, the instructions mandate strict boundary markers, evidence-based validation, and human-in-the-loop decision points for any action following the data retrieval, effectively managing this risk at a low level.

stitch-mcp-list-projects