The Agent Skills Directory

[SAFE]: The skill requires a VERCEL_TOKEN to access registrar data. It follows security best practices by instructing the user to provide this through environment variables rather than hardcoding. All sensitive data is transmitted exclusively to the official Vercel API domain (api.vercel.com), which is a well-known and trusted service.
[COMMAND_EXECUTION]: The skill utilizes a bundled bash script (scripts/check_domains.sh) to perform bulk availability checks. The script is authored with security in mind, utilizing jq to ensure that domain strings are properly escaped and handled as raw data when constructing JSON payloads for the API, effectively mitigating command injection risks.
[EXTERNAL_DOWNLOADS]: The skill makes network requests to Vercel's registrar endpoints. As Vercel is a trusted organization, these communication patterns are considered safe and are strictly limited to the skill's stated purpose of domain lookup and pricing.
[PROMPT_INJECTION]: The skill identifies the project's repository content (e.g., README.md, package.json) as ingestion points for untrusted data to build a product brief. While it lacks explicit boundary markers to delimit this external content, the risk is negligible (Category 8) because the data is used for creative brainstorming of domain names rather than driving execution logic. Furthermore, the check_domains.sh script provides robust sanitization for any generated candidates before they are processed by the system shell or external APIs.

domain-finder