The Agent Skills Directory

[COMMAND_EXECUTION]: The skill employs a local Node.js script (skills/hue/hue.cjs) to convert command-line inputs into structured HTTP request objects. This script acts as a security boundary by validating all parameters (e.g., brightness percentages and color coordinates) before they are sent to the gateway.
[EXTERNAL_DOWNLOADS]: The skill connects to the official Philips Hue CLIP v2 and Remote APIs (e.g., api.meethue.com) to perform lighting operations. These interactions are documented and target a well-known service infrastructure.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its processing of external data from the Hue Bridge (Category 8).
Ingestion points: Data enters the agent context through Hue Bridge API responses for resource listings as defined in SKILL.md and hue.cjs.
Boundary markers: The helper script returns structured JSON data, and SKILL.md instructions mandate that the agent explains the expected physical effect to the operator to obtain approval.
Capability inventory: The skill has the ability to modify lighting states (on/off, brightness, color) and bridge configuration via PUT requests defined in hue.cjs and SKILL.md.
Sanitization: The helper script hue.cjs performs strict input validation, including integer range checks and URL encoding of resource identifiers.
[SAFE]: Credentials such as API keys and OAuth tokens are handled exclusively via secret_ref and secretHeaders, ensuring sensitive tokens are never exposed in the chat history or logs.
[SAFE]: The skill implements a multi-tier safety model (green/amber/red) and requires explicit human approval for any write operations that affect physical devices.

hue