The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill provides patterns for processing external investor data (e.g., firm names, emails, and document links) which could serve as an ingestion point for untrusted content.
Ingestion points: SKILL.md (illustrative validateInvestorData function).
Boundary markers: Not explicitly defined in the provided code snippets.
Capability inventory: Read and Grep tools are allowed in the skill metadata.
Sanitization: The skill demonstrates security best practices by using zod for schema validation and a dedicated redactFintaLog function to sanitize sensitive fields.
[SAFE]: The skill is primarily instructional and does not contain malicious code. The code examples use environment variables for secrets, timing-safe equality checks for signatures, and established validation libraries.

finta-security-basics