The Agent Skills Directory

[DATA_EXPOSURE_&_EXFILTRATION]: The skill implements strong secret management policies. It explicitly instructs the agent to use the --sensitive flag for server-side secrets when using the Vercel CLI, ensuring keys are write-only and not readable via local environment pulls. It also enforces the use of .env.local and .env files which are standard for local development and typically gitignored.
[REMOTE_CODE_EXECUTION]: The skill uses WebFetch and compound-engineering:context7 to retrieve official documentation. While it executes commands like npm install or vercel env add, these are performed in the context of the user's project setup and are necessary for the skill's stated purpose of integrating third-party tools.
[COMMAND_EXECUTION]: The skill provides 'smoke test' commands (e.g., curl or node -e) to verify integrations. These commands use local environment variables and target official vendor APIs (e.g., Stripe, Anthropic), which is a standard verification practice.
[INDIRECT_PROMPT_INJECTION]: The skill ingests external data from official documentation via WebFetch. However, it uses this data to scaffold boilerplate code based on established patterns rather than executing instructions contained within that data. It also prompts the user for a summary review before any files are written, providing a human-in-the-loop checkpoint.
[SAFE]: The skill emphasizes security best practices, such as never skipping webhook signature verification and avoiding the invention of custom authentication patterns. It targets well-known services and trusted platforms like Vercel, Heroku, Stripe, and AWS.

toolify