The Agent Skills Directory

[SAFE]: The skill implements a standard interactive configuration workflow for a specific application (Honcho). It uses dedicated tools (get_config, set_config) to manage application state and provides human-in-the-loop confirmation via AskUserQuestion for sensitive operations like changing hosts or renaming workspaces.
[DATA_EXPOSURE]: While the skill manages configuration data that may include sensitive information (such as host URLs or references to API keys), it does so using the platform's intended toolset. It explicitly instructs the agent not to display raw JSON or sensitive paths, and to wrap visual UI components (the card field) in markdown code fences to maintain data boundaries.
[INDIRECT_PROMPT_INJECTION]: The skill retrieves external data from the get_config tool and reflects it in the agent's prompts and menu descriptions. This represents a typical surface for indirect prompt injection; however, the skill follows best practices by using structured menus and markdown boundaries for external content, and the risk is considered low within the context of a local configuration tool.

honcho-config