The Agent Skills Directory

[SAFE]: The skill implements robust security boundaries by strictly instructing the agent not to request, display, or store sensitive credentials, including the RUNWAYML_API_SECRET and OAuth codes. It correctly advises the user to handle secrets within their own environment or secret managers.
[SAFE]: All external links and resources point to the author's verified domains (runwayml.com, runway.com), which are recognized as legitimate vendor infrastructure.
[COMMAND_EXECUTION]: The instructions include the standard execution of the codex mcp login runway-dev CLI command to facilitate authentication for the local toolset.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The agent is instructed to extract and use signup_url and login_url parameters from MCP error responses (SKILL.md).
Boundary markers: None identified for the data ingested from error responses.
Capability inventory: The skill uses account-related tool calls (whoami, list_projects) and checks environment variables.
Sanitization: The skill does not define validation or sanitization rules for the URLs retrieved from external error responses before they are presented to the user.

runway-dev-setup