The Agent Skills Directory

[SAFE]: The skill provides comprehensive documentation and templates for configuring security infrastructure. All sensitive configuration fields, such as client_secret, api_key, and signing_keys, are represented by clear placeholders (e.g., <PLACEHOLDER> or ${VAR}), ensuring no credentials are leaked.
[SAFE]: External resources, including Docker images (indykite/agent-gateway, indykite/token-service) and documentation links, are hosted on official vendor domains (indykite.com) or vendor-controlled GitHub repositories. These are recognized as legitimate vendor resources.
[INDIRECT_PROMPT_INJECTION]: The skill describes a gateway that processes external data (JSON-RPC, MCP streams, and OAuth tokens). While this is an attack surface, the documentation explicitly details the validation steps (token introspection, chain validation, and AuthZEN policy checks) and sanitization of audit logs to mitigate these risks. As this is the primary purpose of the security gateway, it is considered a safe and necessary function.
[COMMAND_EXECUTION]: The troubleshooting documentation includes benign curl commands for health checks and discovery (e.g., checking /.well-known/openid-configuration). These commands are standard diagnostic tools and do not represent a security risk.

indykite-agent-gateway