The Agent Skills Directory

[SAFE]: No malicious patterns, prompt injections, or unauthorized data exfiltration attempts were detected. The skill focuses on industry best practices for REST API design.
[CREDENTIALS_UNSAFE]: The skill correctly demonstrates using environment variables for sensitive data (e.g., os.environ["CURSOR_SECRET"]) instead of hardcoding secrets.
[OBFUSCATION]: Several Base64 strings are present in SKILL.md and references/http-api-patterns.md. These were decoded and verified as legitimate placeholders for JSON-based pagination cursors (e.g., {"id":123}). No malicious commands were hidden in the encoding.
[INDIRECT_PROMPT_INJECTION]: While the skill is designed to process user-provided API specifications and code, it does not include autonomous execution capabilities that would make it vulnerable to indirect injection. It acts as a set of design constraints and review guidelines.
[REMOTE_CODE_EXECUTION]: The skill provides code snippets for implementation but does not attempt to download or execute external scripts at runtime. The mentioned versions of frameworks (FastAPI, Express, NestJS) are for reference and version-check guidance.

backend-api