The Agent Skills Directory

[SAFE]: The skill strictly enforces OAuth 2.1 best practices such as mandatory S256 PKCE, Pushed Authorization Requests (PAR), and DPoP-bound tokens, significantly reducing the risk of token theft and replay attacks.- [SAFE]: Comprehensive guidance is provided for SSRF hardening when fetching user-derived URLs (DID documents, metadata), including recommendations for blocking private/loopback IP ranges and limiting request sizes.- [SAFE]: The skill references libraries (@atproto/oauth-client-node and @atproto/oauth-client-browser) and documentation services (atproto.mcp.kapa.ai) that are standard and well-known for the protocol's development community.- [SAFE]: External links to repositories under the 'hypercerts-org' GitHub organization (ePDS and certified-group-service) are vendor-owned resources and appear legitimate for the skill's context.- [PROMPT_INJECTION]: The skill describes a process that ingests untrusted data from remote endpoints which could contain malicious instructions designed to manipulate the agent or implementation logic.
Ingestion points: DID document resolution, PDS .well-known resource discovery, and Authorization Server metadata fetching.
Boundary markers: The skill explicitly instructs on identity verification steps (e.g., matching the sub DID against the PDS issuer) to create a security boundary.
Capability inventory: Implementation of this skill results in a system with network fetch capabilities and session storage management.
Sanitization: Recommends extensive validation of handle-to-DID bindings, issuer verification, and network-level SSRF mitigations.

atproto-oauth