The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill makes network requests to onboarding.confidence.dev and events.eu.confidence.dev for telemetry purposes, and to api.optimizely.com to fetch migration data. These are vendor-owned or project-relevant domains.
[REMOTE_CODE_EXECUTION]: During telemetry initialization, the skill executes a shell command that pipes a JSON response from a remote URL to a Python interpreter (curl | python3 -c). This is used to parse a telemetry secret and is part of the vendor's integrated telemetry stack.
[COMMAND_EXECUTION]: The skill uses shell commands for environment setup, telemetry reporting, and API interactions. It explicitly uses the dangerouslyDisableSandbox flag to manage session identifiers and step timers in temporary directories.
[CREDENTIALS_UNSAFE]: The skill demonstrates safe credential handling by instructing the agent not to hardcode or echo API tokens, and instead recommends using environment variables for the Optimizely and Confidence tokens.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external Optimizely configurations and source code.
Ingestion points: Optimizely REST API, local JSON configuration files, and application source code files.
Boundary markers: The skill uses structured plan templates to separate data from instructions.
Capability inventory: The skill possesses the capability to create flags and targeting rules via MCP tools and perform code transformations on local files.
Sanitization: Key normalization and collision detection are implemented, and the skill includes specific instructions to scrub secrets from generated output.

migrate-optimizely