The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes curl to verify OAuth token endpoints and ripgrep (rg) to scan the codebase for hardcoded secrets. These operations are directly aligned with the skill's purpose of performing a security and configuration audit.
[EXTERNAL_DOWNLOADS]: The skill references external documentation and tool catalogs located at docs.scalekit.com and mcp.scalekit.com. These are official vendor-controlled domains used for operational guidance.
[CREDENTIALS_UNSAFE]: The skill handles sensitive environment variables such as SCALEKIT_CLIENT_SECRET. It implements safety measures by instructing the agent to verify the presence of the secret without echoing its value to logs and ensuring the target URL belongs to the official vendor domain (.scalekit.com).
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external vendor documentation (docs.scalekit.com/llms.txt). This represents a potential surface for indirect injection, though the risk is mitigated as the source is the vendor's own documentation infrastructure.

check-agentkit-prod