The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to create and run a temporary script to test integrations. This is protected by strict requirements to use sandbox keys (e.g., sk_test_ for Stripe) and a 'mode guard' that prevents the script from running if it detects a live environment when a sandbox is available.
[DYNAMIC_EXECUTION]: The workflow involves the agent writing a throwaway script based on a provided template that imports local application code. This is used to ensure the test payload is identical to what the application would send in production, ensuring test fidelity without manual payload construction.
[INDIRECT_PROMPT_INJECTION]: The skill processes data returned from external provider APIs (such as parcel statuses or payment event objects). The instructions mitigate injection risks by directing the agent to assert on specific, documented status fields and use these responses to verify successful cleanup.
[DATA_EXPOSURE]: The skill includes a step to analyze production usage to determine test coverage. It explicitly forbids returning individual data rows, requiring instead that results be returned only as aggregate counts to prevent exposure of sensitive production data.
[CREDENTIALS_SAFE]: The instructions mandate best practices for secret handling, including loading credentials only through environment variables, refusing to run if keys do not match expected test prefixes, and explicitly forbidding the inclusion of keys or tokens in evidence files.

provider-canary