The Agent Skills Directory

[SAFE]: The skill serves as a template for Plaid API integration and adheres to secure development principles.
[CREDENTIALS_UNSAFE]: The code snippets correctly utilize environment variables (e.g., process.env.PLAID_SECRET) rather than hardcoding sensitive credentials. The documentation includes explicit validation checks to warn against hardcoding secrets or exposing them to the client side.
[EXTERNAL_DOWNLOADS]: The skill references the official plaid Node.js SDK and react-plaid-link library. These are well-known, industry-standard packages for fintech applications.
[DATA_EXFILTRATION]: No malicious data exfiltration patterns were detected. The skill provides guidance on redacting sensitive banking data and SDK errors before sending responses to the client.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from Plaid API responses and webhooks. While this is a potential ingestion point for external data, the skill mitigates risk by requiring strict webhook signature verification and server-side authentication of user sessions.
[COMMAND_EXECUTION]: There is no evidence of arbitrary command execution or unsafe shell usage. All logic is performed through standard API calls and database operations.

plaid-fintech