The Agent Skills Directory

[SAFE]: No malicious patterns or security risks were identified. The skill focuses on engineering best practices for observability and production operations.
[CREDENTIALS_UNSAFE]: The skill includes guidelines to prevent secret leakage and provides standard placeholders in examples. It explicitly warns against hardcoding secrets or logging them in telemetry (e.g., in SKILL.md and references/security-checklist.md).
[EXTERNAL_DOWNLOADS]: The skill mentions standard development tools like npx lighthouse, npx axe-core, and npx pa11y, which are well-known and widely used in the web development ecosystem for auditing and performance testing.
[INDIRECT_PROMPT_INJECTION]: The skill provides templates for processing telemetry data (logs, metrics, spans) but includes explicit warnings and instructions for redacting sensitive information and PII.
Ingestion points: Log event fields, metric labels, and span attributes defined in SKILL.md and references/observability-checklist.md.
Boundary markers: Explicit instructions to "Never log secrets, tokens, passwords, or full PII" and to "Allowlist fields; don't log whole request bodies."
Capability inventory: The skill provides code templates for instrumentation but does not perform autonomous execution itself; references/security-checklist.md further advises on preventing injection at the application layer.
Sanitization: Redaction of PII and secrets is explicitly mandated as a core process for telemetry emission.

observability-and-instrumentation