The Agent Skills Directory

[SAFE]: The skill follows secure credential management practices by instructing the agent to never ask for or store API keys in the conversation, directing users to set them in environment variables instead. It also prompts users to verify that their environment files are included in .gitignore.
[SAFE]: All external resources, including documentation URLs (spanora.ai) and SDK packages (@spanora-ai/sdk), belong to the verified vendor (spanora). References to these resources are documented neutrally and align with the skill's primary purpose.
[INDIRECT_PROMPT_INJECTION]: The skill reads project configuration files like package.json and pyproject.toml to determine the appropriate integration pattern. While this involves processing untrusted data, the risk is minimal as the skill only uses this information to select from predefined code templates.
Ingestion points: Project root configuration files (package.json, pyproject.toml, requirements.txt).
Boundary markers: None explicitly defined for file contents.
Capability inventory: The skill provides instructions for the agent to suggest file modifications and package installations using the agent's native tools.
Sanitization: None performed on the detected dependency names or project metadata.
[COMMAND_EXECUTION]: The skill provides command-line instructions for installing dependencies using standard package managers (npm, pip, pnpm, yarn, bun, uv, poetry). These are standard installation procedures and do not involve piped remote execution or unknown scripts.

spanora-setup