The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill proactively manages credential safety. scripts/commit-atomic.sh scans staged Git diffs for patterns matching sensitive tokens (e.g., GitHub and Anthropic keys) and blocks commits containing identified secrets. It also restricts the staging of sensitive files like .env, .pem, and credentials.json.
[EXTERNAL_DOWNLOADS]: The skill facilitates the use of third-party extensions via scripts/rent-skill.sh. This process is governed by a mandatory security pipeline where downloaded code is automatically scanned by scripts/skill-security-scan.sh for destructive commands and unauthorized network calls. Users must explicitly opt-in to use extensions flagged as 'risky'.
[COMMAND_EXECUTION]: Automated deployment tasks are protected by multiple layers of defense. scripts/deploy-helper.sh requires a mandatory data backup using restic and enforces a production deployment gate that necessitates manual approval before sensitive operations can proceed.
[DATA_EXFILTRATION]: Communication with external platforms, such as the Telegram escalation feature in scripts/escalate.sh, is handled through secure, local secret management. Project artifacts are only shared with user-configured endpoints using tokens stored in restricted local directories.

loop-coding