The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructs the agent to read API keys from environment variables (NEXUS_API_KEY or NEXUSMODS_API_KEY) and directs users to the official Nexus Mods settings page to generate them. No hardcoded secrets or sensitive paths are present.
[COMMAND_EXECUTION]: The skill provides logic for constructing REST and GraphQL API calls but does not contain instructions for executing arbitrary shell commands or local scripts.
[EXTERNAL_DOWNLOADS]: The skill references several external resources for documentation and reference implementation (e.g., Nexus Mods OpenAPI spec, GraphQL docs, and an official GitHub repository). All referenced domains are official service providers or well-known developer platforms.
[INDIRECT_PROMPT_INJECTION]: The skill handles data from an external API (mod summaries and descriptions) which could theoretically contain malicious instructions. However, the skill explicitly mandates a "Writes need confirmation" step for all publishing or irreversible actions, providing a human-in-the-loop safety boundary.
[DATA_EXFILTRATION]: Network operations are restricted to the official Nexus Mods API endpoints for the purpose of mod management. No patterns for exfiltrating sensitive local data to third-party servers were found.

nexusmods-api