The Agent Skills Directory

[SAFE]: The skill serves as a security guide for API key management. It provides standard industry practices such as environment isolation and secret management.
[INDIRECT_PROMPT_INJECTION]: The skill defines patterns for processing user-supplied prompts. It includes explicit mitigation logic to reduce risks associated with malicious or improper input.
Ingestion points: Untrusted data enters via the prompt variable in the req.json() body in api/ideogram-proxy.ts and the prompt parameter in the sanitizePrompt function.
Boundary markers: None explicitly defined in the prompt interpolation, although the data is structured as JSON for the API request.
Capability inventory: Uses fetch to communicate with the Ideogram API. No unsafe evaluation (eval) or shell command execution is performed using the user input.
Sanitization: Implements length constraints (10,000 characters) and PII redaction for emails, phone numbers, and Social Security Numbers using regular expression replacement.
[COMMAND_EXECUTION]: The instructions include template shell commands for administrative tasks and security controls.
Administrative Commands: Provides curl examples for API verification and CLI usage for vercel, gh, and aws secret management tools.
Security Tooling: Includes a bash script for a git pre-commit hook that uses grep to scan staged changes for potential API key patterns, which is a standard defensive measure.

ideogram-security-basics