The Agent Skills Directory

[SAFE]: The skill provides extensive defensive programming guidance, specifically correcting potential security pitfalls in authentication (e.g., awaiting signature verification), authorization (e.g., verifying document ownership), and input validation (e.g., using Zod schemas). It properly instructs users to handle secrets like API keys and tokens using environment variables and secure CLI tools, rather than hardcoding them.
[INDIRECT_PROMPT_INJECTION]: The skill describes building AI agents and RAG systems, which inherently involves processing untrusted data. Ingestion points: Data enters through agent messages and RAG retrieval pipelines as described in AGENTS-AND-BILLING.md. Boundary markers: The skill explicitly instructs that agent tools must remain authorization boundaries (AGENTS-AND-BILLING.md) and recommends wrapping public functions with identity checks (AUTH.md). Capability inventory: The system possesses capabilities for database mutations (FUNCTIONS-AND-DATA.md), scheduling (KITCN-SCHEDULING.md), and HTTP/Webhook processing (KITCN-HTTP.md). Sanitization: Security is enforced through RLS (Row Level Security), Zod input validation, and server-side identity verification (KITCN-ORM.md, KITCN.md, AUTH.md).

convex