The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill connects to established and well-known technology infrastructure for availability checking, including:
GitHub's public API (api.github.com)
Standard package registries (registry.npmjs.org, pypi.org, crates.io, rubygems.org, api.nuget.org)
IANA-bootstrapped RDAP services (rdap.org) for domain lookups.
These requests are strictly filtered through a security boundary (scripts/net.mjs) that implements a hardcoded host allowlist and enforces a strict slugification protocol to prevent path injection or SSRF attacks.
[COMMAND_EXECUTION]: The skill executes an internal Node.js engine (scripts/naming.mjs) to manage stateful logic and deterministic naming screens. This is the intended architecture of the skill to separate creative LLM work from security-sensitive operations. The command-line interface is used to interact with local scripts using the user's Node.js runtime and does not invoke arbitrary or remote binary code.
[SAFE]: The skill implements significant proactive security measures:
SSRF/Path Injection Protection: The slugify function ensures that any user-suggested or generated name is converted to [a-z0-9-] before being used in network requests, preventing attackers from injecting malicious paths or host headers.
DNS Rebinding Protection: The domain lookup logic includes a resolver that rejects any public hostname resolving to a private, loopback, or reserved IP address.
Credential Safety: The skill requires no credentials. While it can optionally use a GITHUB_TOKEN to increase rate limits, the token is read from the environment and is never logged or persisted in the session state.

naming-is-hard