The Agent Skills Directory

[SAFE]: The skill is designed with a high level of operational discipline and security awareness. Key security-positive features include:
[CREDENTIAL_MANAGEMENT]: Multiple files (specifically SKILL.md and references/connection-setup.md) include explicit instructions never to ask the user to paste secrets (API keys, tokens, etc.) into chat or logs. It provides guidance on using OAuth or local secret stores instead.
[USER_APPROVAL_GATES]: The skill implements a strict requirement for explicit user approval before moving from the design phase (SPEC) to the implementation phase. It also requires the user to explicitly end the interview process.
[VALIDATION_PROCEDURES]: The skill includes detailed validation steps for connections and the resulting knowledge base, ensuring that the implementation matches the approved design and functions correctly.
[EXTERNAL_DEPENDENCY_CONTROL]: The skill uses a defined dependency (light-research) for external fact-finding, rather than arbitrary web access, and provides a 'research-contract' to ensure research is focused and safe.
[FALSE_POSITIVE_RESOLUTION]: Static analysis flagged potential concealment patterns. Upon review, these instructions (e.g., 'Do not normally expose the whole map to the user') were found to be legitimate UX/noise-reduction strategies and instructions for maintaining accuracy (not claiming research has started before the system acknowledges it), rather than attempts to hide malicious behavior.

kb-init