The Agent Skills Directory

[SAFE]: The skill implements secure credential management by instructing users to store API keys in environment variables (e.g., process.env.CASTAI_API_KEY) rather than hardcoding them within the scripts.
[SAFE]: The skill includes explicit guidance to redact API keys and authorization headers from logs, preventing accidental data exposure during operation.
[SAFE]: Network operations are directed solely to the official CAST AI API domain (api.cast.ai) and official GitHub documentation, which are well-known and legitimate services for this skill's context.
[INDIRECT_PROMPT_INJECTION]: The skill provides patterns for processing external data from the CAST AI API.
Ingestion points: API response data is ingested through methods like listClusters, getSavings, and listNodes defined in SKILL.md.
Boundary markers: The patterns provide typed interfaces in TypeScript (e.g., CastAICluster, CastAINode) and specific data access methods in Python to structure and limit the scope of incoming data.
Capability inventory: The skill uses standard network libraries (fetch in TypeScript, requests in Python) to interact with the API endpoints.
Sanitization: The instructions explicitly require the implementation of a client boundary that returns "typed, redacted domain data" and avoids "unfiltered provider responses," which serves as a robust defense against potentially malicious external data.

castai-sdk-patterns