The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references official GitHub release pages and RFC documentation for version pinning and security advisories (e.g., FastAPI, Express, NestJS). These references target well-known, trusted organizations and are used solely for informational purposes and version verification, with no automated remote code execution patterns.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to handle and define boundaries for untrusted data entering an application via HTTP API request bodies, headers, and parameters.
Ingestion points: API request DTOs and route parameters defined in the implementation steps (Step 3 and Step 5).
Boundary markers: The skill mandates the use of server-side validation boundaries and explicit authorization scopes to isolate untrusted input.
Capability inventory: The provided code examples demonstrate interaction with environment variables (os.environ) for secret management and database transactions for idempotency.
Sanitization: It explicitly requires the use of Pydantic models (FastAPI), Pipes (NestJS), and validation middleware (Express) to sanitize and validate all external content before it reaches business logic.
[CREDENTIALS_SAFE]: Code examples demonstrate secure practices for handling sensitive data, such as retrieving secrets from environment variables and using HMAC-SHA256 signatures for tamper-proof pagination cursors. No hardcoded credentials or insecure secret storage patterns were found.
[OBFUSCATION]: Several Base64 strings are present in examples for pagination cursors (e.g., eyJpZCI6MTIzfQ). These were decoded and found to be benign JSON data ({"id":123}) consistent with the skill's instructional purpose.

backend-api