The Agent Skills Directory

[SAFE]: The skill provides architectural guidance for implementing phishing-resistant authentication methods (Passkeys and Sign in with Apple) and secure hosted OAuth flows using ASWebAuthenticationSession.
[SAFE]: All network references, such as appleid.apple.com, point to well-known, official service endpoints for identity verification.
[INDIRECT_PROMPT_INJECTION]: The skill documents surface areas where untrusted data enters the agent context via authentication callbacks and identity tokens.
Ingestion points: Data enters through ASAuthorizationControllerDelegate (identity tokens, authorization codes) and ASWebAuthenticationSession callback URLs.
Boundary markers: The skill explicitly instructs on the use of nonces, JWT signature verification, and PKCE (Proof Key for Code Exchange) to secure these boundaries.
Capability inventory: The skill describes patterns for network operations (sending credentials to a backend server) but does not include any arbitrary command execution or unsafe file-writing capabilities.
Sanitization: Implementation guides require cryptographic verification of signatures (RS256/ES256) and validation of claims (issuer, audience, expiration) before processing external data.
[SAFE]: Sensitive data management follows best practices, recommending Keychain for token storage and advising against the use of UserDefaults for sensitive information.

authentication