The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/validate.py utility invokes the djlint command-line tool via subprocess.run to validate the syntax of Nunjucks templates located in the skeleton directory. The command is constructed using a list of arguments and targets local files, minimizing risks of shell injection.
[INDIRECT_PROMPT_INJECTION]: The skill processes external codebases through scripts/analyze.py to identify candidate strings for parameterization. While this introduces an ingestion point for untrusted data, the risk is mitigated by the skill's 'Interactive Authoring' principle, which requires explicit user review and confirmation of each proposed mapping before any file modifications occur.
[DATA_EXFILTRATION]: The skill facilitates network communication with RHDH Scaffolder APIs (such as dry-run and action discovery endpoints) using urllib.request. These operations use a user-specified RHDH base URL and authentication tokens retrieved from standard environment variables (RHDH_TOKEN, BACKSTAGE_TOKEN). These network operations are strictly for the purpose of template testing and metadata retrieval as part of the intended developer workflow.
[CREDENTIALS_SAFE]: The skill explicitly enforces security conventions that prevent the inclusion of literal secrets in templates. It includes a fix-gotchas script with patterns to detect hardcoded tokens and directs users to utilize Backstage's Secret widgets and integration-based secret references instead.

rhdh-templates