The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the user to execute vendor-provided CLI tools and standard package managers.
Uses npx @reopt-ai/cli brandapp init to scaffold the development environment.
Executes npm install, pnpm add, or yarn add to install the @reopt-ai/brandapp-sdk and its peer dependencies.
Runs npx tsc --noEmit for compilation checks and tsx for build-time schema hashing.
[EXTERNAL_DOWNLOADS]: The skill configures the project to fetch dependencies from authorized registries.
Configures .npmrc to point the @reopt-ai scope to the GitHub Packages registry (https://npm.pkg.github.com).
This is a standard procedure for accessing private or scoped packages.
[CREDENTIALS_UNSAFE]: The skill demonstrates safe practices for managing sensitive credentials.
Recommends using environment variables (${GITHUB_TOKEN}) in .npmrc instead of hardcoding tokens.
Uses .env.local for sensitive values like BRANDAPP_CLIENT_SECRET and BETTER_AUTH_SECRET, noting that these should be git-ignored.
Explicitly uses the server-only package in generated code to prevent secrets from being bundled into the client-side code.
[SAFE_PRACTICES]: The skill includes several security-conscious recommendations.
Provides a Zod-based schema for environment variable validation at startup.
Issues a clear warning against using NODE_TLS_REJECT_UNAUTHORIZED=0 in production environments.
Implements 5-minute replay protection by default for webhook handlers.

brandapp-sdk-install