The Agent Skills Directory

[SAFE]: The skill is entirely educational, providing best practices for API security without executing dangerous commands or accessing sensitive local data.
[CREDENTIALS_UNSAFE]: The documentation correctly identifies hardcoded secrets as a security risk and instructs developers to use environment variables (process.env.JWT_SECRET) instead. No real credentials or API keys are included.
[COMMAND_EXECUTION]: Code examples demonstrate safe patterns such as parameterized SQL queries and input validation using the Zod library to prevent injection attacks.
[EXTERNAL_DOWNLOADS]: The skill references standard, well-known libraries (e.g., jsonwebtoken, bcrypt, helmet, zod) and provides links to reputable security resources such as OWASP and IETF.
[DATA_EXFILTRATION]: No network operations or data exfiltration patterns were detected. The examples focus on server-side logic and proper response sanitization to avoid leaking sensitive information (e.g., excluding passwordHash from API responses).

api-security-best-practices