The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill's evaluation and reference files contain hardcoded sensitive information.
evals/files/orders_deps.py and evals/files/reports_router.py contain hardcoded database credentials in connection strings: postgresql://app:app@db/app.
evals/files/test_orders_api.py contains hardcoded authentication headers: Bearer real-token-from-my-shell-history and Bearer real-token.
[EXTERNAL_DOWNLOADS]: The skill explicitly instructs users to install an unverifiable third-party package, httpx2, claiming it is required by 'Starlette 1.6'. As of the current date, Starlette is in the 0.x version range, and httpx2 is not a recognized official successor to the httpx library. This recommendation for a specific, version-pinned (2.12) external package under deceptive pretenses represents a high-risk supply chain attack vector.
Evidence in references/tooling.md: uv add --group test httpx2.
Evidence in references/testing.md: 'Starlette 1.6's test client imports httpx2... install httpx2 instead.'
[INDIRECT_PROMPT_INJECTION]: The skill provides patterns for building web APIs that process untrusted external data via FastAPI and Pydantic, creating a surface for indirect injection attacks.
Ingestion points: Path operations in evals/files/orders_deps.py and evals/files/reports_router.py ingest data through the payload: dict and report_id: int arguments.
Boundary markers: None implemented; instructions focus on standard Pydantic validation without specific delimiters for prompt-interpolated data.
Capability inventory: The skill uses requests.get for network operations and sqlalchemy for database execution in several files.
Sanitization: The skill relies on default Pydantic validation as described in references/pydantic-models.md but does not provide additional sanitization for downstream logic.

fastapi