The Agent Skills Directory

Secure OAuth 2.0 Implementation: The skill implements the Authorization Code flow with Proof Key for Code Exchange (PKCE). This process includes generating a unique code verifier and challenge per session and using cryptographically secure 'state' tokens to prevent CSRF and interception attacks.
Defensive Credential Management: Credentials are saved to the OS keychain or local files using a three-tier lookup system. On-disk storage uses restricted '0600' (owner-only) file permissions and atomic write operations (via temporary files and replacement) to protect secrets at rest.
Active Log Redaction System: The _redact utility is used throughout the package to ensure that access tokens, refresh tokens, and client secrets are automatically scrubbed from stderr and log files, preventing accidental information disclosure.
Cross-Process Serialization: The implementation uses advisory file locks to synchronize access to the token store. This prevents concurrent read/modify/write races between multiple instances of the skill running on the same workstation.
Dynamic Backend Loading: The skill allows users to specify custom keyring backends through environment variables. This uses dynamic module loading, which is a standard pattern for extensible CLI tools and is appropriately scoped to the operator's execution environment.
Input and URL Validation: The tool performs strict validation on identifiers and URLs, including a security allowlist for Azure SAS links used during image uploads, which helps prevent Server-Side Request Forgery (SSRF).

mural