The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill provides explicit instructions to protect the OWS API key by keeping it only on the server in environment variables or a secret manager. It correctly identifies that the portal browser bundle must never contain the key, which is a standard security best practice for managing sensitive secrets.
[EXTERNAL_DOWNLOADS]: The instructions recommend using npx create-next-app for project scaffolding and include references to the Better Auth library and official iGrant.io documentation. These are legitimate resources from well-known services relevant to the skill's primary purpose.
[INDIRECT_PROMPT_INJECTION]: As a recipe for a business wallet, the resulting application will inherently process untrusted external data from credential issuers and verifiers using OpenID4VC and DCQL protocols.
Ingestion points: Data enters the system through components like ReceivedCredentialsView.tsx and the NotificationsInbox.tsx mentioned in SKILL.md.
Boundary markers: The skill does not define specific boundary markers for the data handled by the UI components.
Capability inventory: The system architecture includes a backend proxy that interacts with OWS APIs and a frontend that renders claims from external credentials.
Sanitization: While the umbrella skill does not detail sanitization logic, it points to a structured portal-ux-reference.md and reference components for implementation.

igrantio-business-wallet-portal