The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process authentication data and user profiles from external identity providers, which represents a potential injection surface if the external provider is compromised.
Ingestion points: Data enters the system via exchangeCodeForTokens, fetchUserInfo, and discoverOIDCConfig in SKILL.md through network requests to external endpoints.
Boundary markers: The implementation includes HTTP response status checks and mandates JWT signature verification using the jose library, providing technical boundaries for the data received.
Capability inventory: The skill utilizes fetch for network communication and cookies.set for session management.
Sanitization: The mapUserInfo function in lib/auth/providers.ts performs schema mapping, ensuring only expected fields (id, email, name, image) are processed from external provider responses.
[SAFE]: The skill follows established security best practices for authentication implementation, including the use of environment variables for secrets, PKCE for public and confidential clients, and secure cookie configurations.

oauth2-oidc-implementer