The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill facilitates the installation of official libraries and SDKs from vendor-controlled sources, such as the @scalekit-sdk/node NPM package and the scalekit-sdk-go Go module. These are used to manage authentication and token exchange with the provider.
[COMMAND_EXECUTION]: The skill includes instructions to execute package manager commands (npm install, go get, composer require) to set up the necessary development environment and dependencies for the authentication flow.
[INDIRECT_PROMPT_INJECTION]: The skill implements endpoints that ingest untrusted data from external sources, which constitutes a potential attack surface.
Ingestion points: Authorization codes are read from URL query parameters in the /auth/callback route in SKILL.md and references/go.md.
Boundary markers: The instructions do not include specific delimiters or "ignore previous instructions" warnings when processing the received codes.
Capability inventory: The skill uses network capabilities to send the ingested codes to the Scalekit environment URL via SDK methods like authenticateWithCode.
Sanitization: There is no explicit sanitization of the query parameters before they are passed to the SDK, although the library handles the exchange protocol.
[SAFE]: The skill adheres to security best practices by recommending the use of HttpOnly, Secure, and SameSite: 'lax' flags for session cookies. It also explicitly warns against storing tokens in localStorage and emphasizes server-side token validation over trusting raw JWT claims.

implement-saaskit