The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data from the Salla app publication draft (ingested via app_publish action=get). While this data could theoretically contain malicious instructions, the skill implements strong procedural controls. It operates in a "readiness-driven loop" requiring manual intervention and partner confirmation for each section. The final publication is hard-gated behind a partner review of the portal link and an explicit confirm: true parameter, minimizing the risk of automated exploitation.
[CREDENTIALS_UNSAFE]: The skill references trial_username and trial_password for reviewer access. However, it explicitly instructs that these should be "test-only" and "redacted in logs, never stored plaintext". The examples provided (reviewer@example.com, Demo-Review-2026) are clearly for demonstration purposes and do not represent actual credentials.
[EXTERNAL_DOWNLOADS]: The skill references official Salla domains (portal.salla.partners, salla.dev) for documentation and the publication portal. It also includes a reference to YouTube for a demo video. These are trusted vendor resources and well-known services, posing no security risk.

salla-publication-consistency