The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill performs automated scans of local files (.env, package.json, .sentryclirc) for sensitive credentials and high-privilege tokens.
Specifically, it searches for SUPABASE_SERVICE_ROLE_KEY, SENTRY_AUTH_TOKEN, and LANGFUSE_SECRET_KEY using grep patterns.
Accessing service role keys is highly sensitive as these credentials bypass Row Level Security (RLS) policies.
[EXTERNAL_DOWNLOADS]: The skill utilizes npx langfuse-cli to interact with Langfuse APIs.
This involves downloading and executing the CLI tool from the npm registry. Langfuse is a well-known service, and this execution is required for the skill's primary verification purpose.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to the ingestion and processing of untrusted data from multiple external sources.
Ingestion points: Reads Sentry issue descriptions, Supabase API/Edge/Auth logs, and live web page content (console messages and snapshots) via Playwright.
Boundary markers: No explicit delimiters or instructions are provided to the agent to ignore potentially malicious content within these logs or pages.
Capability inventory: The skill has the capability to execute shell commands (npx), make MCP tool calls (Supabase, Sentry, Playwright), and generate deployment verdicts.
Sanitization: There is no evidence of sanitization or filtering of the ingested external content before it is processed by the agent to determine the final 'ship-or-rollback' verdict.

deploy-verify