The Agent Skills Directory

[COMMAND_EXECUTION]: The skill documents the use of the vendor's CLI tool (speakeasy generate sdk) to regenerate the SDK code. This is a standard operation within the intended development workflow.
[DATA_EXFILTRATION]: The documentation includes an example of implementing telemetry by sending operation data to an external endpoint (telemetry.example.com). This is documented as a common use case for observability and uses a placeholder domain.
[CREDENTIALS_UNSAFE]: The skill provides code patterns for handling authentication secrets, such as HMAC signing keys. The examples demonstrate accessing these secrets dynamically through the SDK's context (hookCtx.securitySource?.apiSecret) rather than hardcoding them, which aligns with security best practices for code templates.
[INDIRECT_PROMPT_INJECTION]: The skill describes implementing hooks that intercept and process data from external API requests and responses. While this creates a potential attack surface for indirect prompt injection if the intercepted data contains malicious instructions, the skill focuses on providing structural guidelines for implementation.
Ingestion points: BeforeRequestHook and AfterSuccessHook process external data from requests and API responses.
Boundary markers: The skill advises cloning response objects before consumption to preserve data integrity, though it does not explicitly mandate input sanitization.
Capability inventory: The generated SDKs are capable of network operations and header manipulation.
Sanitization: The implementation of data sanitization is left to the developer implementing the specific hook logic.

customize-sdk-hooks