The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill directs the agent to install standard libraries from public registries, including the vendor's official SDKs (@scalekit-sdk/node and scalekit-sdk-python). These downloads are necessary for the skill's stated purpose and originate from the authoring organization.
[COMMAND_EXECUTION]: The instructions include standard npm install and pip install commands for setting up the development environment, and curl commands for verifying that the local authentication server is correctly returning 401 status codes and metadata headers.
[CREDENTIALS_UNSAFE]: The skill follows security best practices by instructing the agent to read sensitive credentials (Client ID and Client Secret) from environment variables rather than hardcoding them into the source code.
[INDIRECT_PROMPT_INJECTION]: While the resulting code implements an endpoint that processes external Authorization headers, the skill includes robust mitigation instructions by requiring token validation against a specific audience and issuer via the Scalekit SDK.

add-mcp-oauth