The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill interacts with vendor-controlled endpoints and resources to facilitate authentication.
Communicates with https://login.iblai.app/connect and https://api.iblai.app/dm/api/core/token/verify/ for credential exchange and verification.
References documentation hosted at https://raw.githubusercontent.com/iblai/vibe/refs/heads/main/docs/skill-setup.md.
[COMMAND_EXECUTION]: The skill executes local commands to perform the connection task.
Runs the bundled connect.mjs script using node.
Spawns system browser processes using open (macOS), cmd /c start (Windows), or xdg-open (Linux) to navigate to the login URL.
[INDIRECT_PROMPT_INJECTION]: The skill manages a network-based data ingestion surface that is used to receive authentication data from the browser.
Ingestion points: A temporary HTTP server started on 127.0.0.1 in scripts/connect.mjs to receive authentication codes via a callback URL.
Boundary markers: The implementation utilizes a cryptographically random state parameter as a CSRF guard; the script ignores any callback where the received state does not match the generated one.
Capability inventory: The script has capabilities to write to local configuration files (.env, .env.local, iblai.env), update .gitignore, and perform network operations to vendor APIs.
Sanitization: The script performs strict matching of the state parameter and validates the resulting API token against the vendor's verification endpoint before writing any data to disk. It also includes functions to mask tokens and redact them from console output.

iblai-vibe-connect