The Agent Skills Directory

[SAFE]: The skill implements a password gate using industry-standard security practices, including the use of node:crypto's scryptSync for memory-hard password hashing and timingSafeEqual for constant-time comparisons to prevent timing attacks.
[SAFE]: The middleware templates include dedicated sanitization functions such as sanitizeReturnPath (which prevents open redirects by checking for protocol-relative paths and control characters) and escapeHtml (which mitigates XSS risks in the dynamically generated unlock form).
[SAFE]: The remove-proxy-on-prod.mjs build script is designed for cost optimization on the Vercel platform. It uses a strict file-content marker (@deploy-gate:managed) to ensure it only deletes the skill's own generated middleware files and does not affect the user's project code.
[SAFE]: Host matching logic in unprotectedHosts and isUnprotectedHost uses exact matching and port-stripping, avoiding risky substring or wildcard matches that could lead to unintended exposure of subdomains.
[INDIRECT_PROMPT_INJECTION]: The skill has an ingestion surface for untrusted data via HTTP headers (Host, x-deploy-gate-bypass) and query parameters. However, these inputs are validated against strict patterns (e.g., HOSTNAME_PATTERN) and are only used for routing decisions, cookie validation, and sanitized redirects. The risk is minimized by existing security boundaries and the limited scope of the middleware's capabilities.

vercel-deployment-password-gate