The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill follows security best practices by explicitly instructing users NOT to hardcode secrets in the configuration file. It uses api_key_env to reference environment variable names (e.g., KIMI_API_KEY) and implements a validator in src/llm_tools/config.py (_no_secret_in_env_name) that raises an error if an actual API key (starting with sk-) is mistakenly placed in the configuration file.
[COMMAND_EXECUTION]: The skill executes shell commands via the setup.sh script, but these are standard installation procedures (using uv tool install) and do not involve untrusted remote code or injection vulnerabilities.
[DATA_EXFILTRATION]: While the skill sends local file content and transcripts to external LLM providers (DeepSeek, Kimi, OpenRouter, Ollama), this is the primary intended function. The documentation (README.md and SKILL.md) correctly warns the user not to delegate tasks involving auth, payments, or PII and to redact credentials from files before processing.
[EXTERNAL_DOWNLOADS]: The setup.sh script suggests downloading uv from the official Astral GitHub repository, which is a well-known and trusted source for Python tooling.

llm-tools