The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains instructional language and coding standards (e.g., 'MUST USE', 'BANNED' patterns). These are legitimate development guidelines intended for the AI agent to follow when assisting a developer and do not constitute malicious injection or jailbreak attempts.
[COMMAND_EXECUTION]: A local shell script scripts/scaffold-audit.sh is provided to audit project directories for compliance with scaffolding standards. The script performs read-only filesystem operations such as checking directory structures, file existence, and line counts using standard tools like find and grep.
[EXTERNAL_DOWNLOADS]: The documentation references established third-party tools and libraries from well-known services (e.g., oasdiff from GitHub, standard packages from NPM and PyPI). These references are part of legitimate development workflows for API testing and service implementation.
[DATA_EXFILTRATION]: No exfiltration patterns were detected. In fact, the skill provides explicit guidance on preventing data leaks, including rules against hardcoding secrets, configuring CORS properly, and using parameterized queries to prevent SQL injection.
[CREDENTIALS_UNSAFE]: The skill contains documentation examples of hardcoded secrets (e.g., 'sk-abc123...') in the anti-slop-backend.md file, but these are explicitly marked as 'BANNED' and 'BAD' examples to educate the user on what to avoid. No real credentials are exposed.

dev-backend