The Agent Skills Directory

[SAFE]: The skill implements security best practices in its accompanying scripts. The profile_store.py utility explicitly identifies and blocks the persistence of sensitive data such as tokens, secrets, passwords, and API keys through a pre-defined blocklist (SENSITIVE_PARTS). Furthermore, it uses atomic write operations and secure temporary files for profile updates.
[SAFE]: The source validation script (validate_skill.py) uses yaml.safe_load to prevent insecure YAML deserialization attacks and includes hygiene checks to prevent the leakage of private absolute file paths from the author's environment.
[INDIRECT_PROMPT_INJECTION]: The skill has an inherent attack surface for indirect prompt injection as it ingests and processes untrusted project data.
Ingestion points: The workflow reads project names and framework configuration files (e.g., package.json, Vite/Next.js configs) from the target workspace to determine existing port settings.
Boundary markers: The skill does not explicitly use boundary markers, but its execution is strictly limited by the defined workflow in SKILL.md which focuses on port arithmetic and configuration writing.
Capability inventory: The skill utilizes the agent's filesystem capabilities to modify configuration files in the target project.
Sanitization: The skill incorporates sanitization via profile_store.py which filters sensitive keywords before storing any data in the persistent profile.

lov-init-port