The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill follows secure credential management practices. Environment variables for API keys and database connection strings use placeholders in .env.example (e.g., postgresql://user:pass@localhost:5432/{{PRODUCT_SLUG}}_agent). The documentation explicitly instructs users to keep sensitive configurations in .env files and warns against enabling development tools like dev-chat in production.
[EXTERNAL_DOWNLOADS]: The skill references standard, well-known libraries such as LangChain, PostgreSQL (pg), and OpenTelemetry. External script references in the dev-chat template (e.g., PicoCSS, Marked, DOMPurify) are from established CDNs and are plain-text references for legitimate UI functionality.
[REMOTE_CODE_EXECUTION]: The bootstrap-agent-runtime.mjs script is a local utility for scaffolding the project by copying templates. It performs standard file system operations without downloading or executing untrusted remote code. The MCP (Model Context Protocol) client is designed with a governance layer that requires explicit allowlisting and local classification of tools, preventing unauthorized remote execution.
[DATA_EXFILTRATION]: The skill implements strict data handling via its 'Context Window' and 'Evidence and Fidelity' doctrines. It includes mechanisms for truncating tool outputs, redacting secrets in logs, and ensuring that sensitive state information is not persisted in conversation history or durable checkpoints.
[PROMPT_INJECTION]: The skill includes defensive measures against prompt injection, such as a dedicated guard node for turn-level classification and the use of composed system prompts that separate the 'Motor' (invariants) from the 'Product' (persona). It also establishes stop conditions to prevent agent loops and overspending.
[OBFUSCATION]: No obfuscated code, multi-layer Base64, zero-width characters, or homoglyph-based URL attacks were detected across the 117 files analyzed. The code is highly readable and documented.
[INDIRECT_PROMPT_INJECTION]: The skill explicitly addresses the risk of indirect injection by defining a doctrine for truncating and normalizing external data (like MCP tool results) before it enters the LLM context, minimizing the attack surface for embedded malicious instructions.

ns-langgraph-agents