The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: No remote code execution patterns or suspicious download-and-execute commands were detected. The skill primarily contains educational code snippets demonstrating secure development practices.
[EXTERNAL_DOWNLOADS]: The skill mentions common security-focused Node.js packages in code examples (e.g., helmet, zod, dompurify). These are standard libraries from a well-known ecosystem and are presented for defensive purposes.
[DATA_EXFILTRATION]: No data exfiltration patterns were found. The skill includes instructions on how to properly manage secrets using .env files and environment variables, advocating for secure practices like adding .env to .gitignore.
[PROMPT_INJECTION]: The skill explicitly warns about prompt injection (LLM01) and provides strategies to mitigate it. It does not contain any instructions that attempt to override agent behavior or bypass safety filters.
[INDIRECT_PROMPT_INJECTION]: While the skill is designed to handle and analyze code related to user inputs (creating an attack surface), it focuses entirely on validation, sanitization, and least privilege. It contains no executable scripts that could be manipulated via untrusted data.
[CREDENTIALS_UNSAFE]: No hardcoded credentials or secrets were found. The skill provides clear instructions on avoiding hardcoded keys and using placeholder patterns like 'process.env.STRIPE_API_KEY'.
[OBFUSCATION]: No malicious obfuscation (Base64, zero-width characters, or homoglyphs) was detected. A benign HTML comment '' is used as a metadata tag for security scanners.

security-and-hardening