The Agent Skills Directory

[OBFUSCATION]: The deterministic detection of unicode steganography in 'skillscan.ts' is a false positive. The identified unicode characters are part of a regular expression designed to detect and block hidden characters in user-submitted skills, a security measure rather than an attack vector.- [DATA_EXFILTRATION]: The code communicates with well-known and trusted service providers (Stripe, Resend, OpenRouter, TypeSafe) strictly for functional requirements such as billing, alerting, and model inference. It incorporates privacy-enhancing pseudonymization ('privacy.ts') to ensure that IP addresses and label sets are never stored in a reversible format.- [REMOTE_CODE_EXECUTION]: The application includes a security-focused 'cleaner' ('skillscan.ts') that proactively identifies and blocks remote code execution patterns, such as piping downloads to interpreters or using unsafe deserialization, within any content processed by the agent.- [SAFE]: The codebase adheres to industry security standards, utilizing PBKDF2 for key derivation, implementing strict Content Security Policies (CSP) with script hashing, and enforcing constant-time HMAC comparisons to mitigate timing attacks on authentication endpoints.

bulk-classify