The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a dedicated Python wrapper (run.py) to execute the xparse-cli and easyclawcli tools. It prevents command injection by using subprocess.run with shell=False and strictly enforcing a whitelist of allowed commands (parse, search_text, etc.).
[CREDENTIALS_UNSAFE]: The execution logic includes an automated environment scrubber (safe_env) that removes sensitive environment variables such as APP_ID, APP_SECRET, and various tokens before sub-processes are launched. Additionally, it blacklists CLI flags like --access-token and --client-secret to ensure credentials cannot be passed via command-line arguments.
[DATA_EXPOSURE]: The skill enforces a strict schema for task context files. The valid_task_context function verifies that the file is a small JSON object containing only specific, non-sensitive metadata fields (user_intent, tool_call_reason) before processing, mitigating risks associated with reading arbitrary files.
[SAFE]: The skill follows security best practices by delegating authentication to an external manager (easyclawcli) and providing structured error handling for various service states (e.g., quota limits or expired sessions) without exposing internal logic or credentials.

textinxparse