The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill implements robust security logic to prevent the accidental exposure of API keys. It enforces resolving credentials from environment variables or .env files and includes dedicated utility functions (mask_key and sanitize_diagnostic) to redact secrets from logs and error messages.
[EXTERNAL_DOWNLOADS]: The skill retrieves model configuration and capability catalogs from official Alibaba Cloud CDN domains (alioth-intl.alicdn.com). These downloads are performed using the standard library and target trusted vendor infrastructure.
[DYNAMIC_EXECUTION]: The gossamer.py utility uses subprocess.run to execute a companion update-checking script. The target script path is dynamically resolved relative to the skill's installation directory, and the execution is restricted to the system's current Python interpreter for the purpose of version verification.
[INDIRECT_PROMPT_INJECTION]: As a tool designed to process user-supplied text for language model interaction, the skill possesses an inherent attack surface for indirect prompt injection. However, it mitigates this by following standard implementation patterns, such as using structured message roles and providing instructions to agents to respect user-specified parameters.

qwencloud-text