The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains strong instructions such as 'Do Not Trust Internal Knowledge' and 'Forbidden APIs'. These are technical guardrails designed to prevent the LLM from hallucinating incorrect API calls, which is a common issue with SDK version changes. The instruction to 'Show at most a masked preview in chat; never print a full key' is a defensive measure to protect user secrets, not a malicious attempt to conceal the agent's actions.
[DATA_EXFILTRATION]: The skill describes an integration with a Scandit MCP server (https://ssl.scandit.com/mcp) for managing trial license keys. It explicitly restricts the agent from searching the project's local files or environment for existing keys, which prevents unauthorized credential harvesting.
[EXTERNAL_DOWNLOADS]: The skill references several Flutter packages (scandit_flutter_datacapture_core, scandit_flutter_datacapture_id, etc.) and documentation hosted on scandit.com and github.com/Scandit. These are all verified vendor resources from 'scandit' and do not pose a third-party supply chain risk.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process identity documents. It provides specific guidance on using IdAnonymizationMode to limit the exposure of sensitive fields and images, reducing the risk of accidental data leakage during the processing of untrusted document data.

id-capture-flutter