The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses local shell scripts (verify.sh) and standard utilities like psql, node, and ffmpeg to manage test databases and run the application's sidecar processes. These actions are scoped to the local development environment and used for legitimate verification purposes.
[EXTERNAL_DOWNLOADS]: Instructions include running pnpm install to fetch project dependencies from the official NPM registry. This is standard behavior for Node.js development projects.
[CREDENTIALS_UNSAFE]: The skill implements a 'fail closed' security posture by intentionally replacing environment variables for external services (AWS, OpenAI, Anthropic, etc.) with dummy values like verify-cvm-offline. It also includes utility functions to redact passwords from database URLs in logs.
[DATA_EXFILTRATION]: Network security is enforced by redirecting external service API URLs to a discard port (127.0.0.1:9) by default. The skill only allows overrides to loopback addresses (localhost), ensuring no data is sent to the public internet during verification runs.
[SAFE]: The skill demonstrates high security awareness by enforcing read-only transaction modes (default_transaction_read_only=on) when connected to production databases and providing a 'Write Ledger' to audit any changes made to the local test clones.

verify-cvm