The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill demonstrates a strong security posture regarding credentials. It provides explicit instructions and scripts for auditing repositories for leaked secrets, implements a pre-commit hook to block credential commits, and provides implementation guides for integrating with AWS Secrets Manager, GCP Secret Manager, and SOPS. No hardcoded credentials were found in the skill's files.
[COMMAND_EXECUTION]: The skill uses the Bash tool to execute its own Python scripts and curl for interacting with official Podium API endpoints. These operations are restricted to the functional domain of authentication and credential management.
[EXTERNAL_DOWNLOADS]: The skill interacts with accounts.podium.com and api.podium.com. These are well-known, official services required for the Podium integration and are considered safe under the trust scope rules.
[DATA_EXFILTRATION]: No unauthorized data exfiltration patterns were detected. The skill handles sensitive OAuth2 tokens (access and refresh tokens) using atomic write operations to local storage or designated secret managers. It also includes logic to redact sensitive fields like access_token and client_secret from logs.
[DYNAMIC_EXECUTION]: While the skill provides code templates for Python and TypeScript, it does not use unsafe dynamic execution functions like eval() or exec() on untrusted or external data.

podium-auth