The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze entire workspaces, which inherently includes processing untrusted content such as third-party library code and external documentation. It includes robust defenses against this attack surface.
Ingestion points: Processes repository source code, configuration manifests, and documentation retrieved via MCP servers.
Boundary markers: Explicitly instructs the agent to distinguish between supplied evidence and freshly checked sources, and to ignore 'hostile' diagnostic instructions found in documentation (e.g., instructions to upload secrets).
Capability inventory: Capable of generating and executing local test spikes, proposing file modifications, and utilizing MCP tools for documentation lookup.
Sanitization: Strict guidelines prohibit the retrieval, storage, or transmission of credentials, secrets, or sensitive customer records.
[DATA_EXPOSURE_&_EXFILTRATION]: The skill contains multiple layers of protection against accidental data leakage. It instructs the agent to avoid secret-bearing files, use read-only queries for production inspection where authorized, and prefer synthetic fixtures over real customer data. It specifically forbids asking users to paste credentials into the chat.
[COMMAND_EXECUTION]: While the skill can generate and run local tests (e.g., using node --test), it mandates that these be standalone, disposable spikes. It requires explicit user authorization before any implementation phase and emphasizes using local fakes and mocks to prevent unintended side effects on external systems.

idiomatic