The Agent Skills Directory

[SAFE]: The skill and its associated reference files are educational in nature, providing robust patterns for TypeScript development. The instructions focus on security-positive behaviors such as avoiding the any type, implementing strict runtime validation at boundaries, and using branded types to track sanitization states.
[INDIRECT_PROMPT_INJECTION]: The skill provides patterns for the agent to ingest and process untrusted data from API responses, forms, and environment variables. However, it mandates strict validation and sanitization as core requirements, mitigating the risk of injection in the generated code.
Ingestion points: External data processed in API response handling (api-response.md), form validation (form-validation.md), and environment configuration (zod-integration.md).
Boundary markers: The skill instructs the agent to use Zod schemas (safeParse) as explicit runtime boundaries for all external data.
Capability inventory: Examples across the files include networking (fetch), file system interactions (fs), and database queries (db.execute).
Sanitization: The skill documents and requires sanitization patterns using branded types (e.g., SanitizedHtml, SafeSql) to prevent XSS and SQL injection, as detailed in branded-types.md.

typescript-dev