The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes scripts for version checking, backend exporting, and frontend deployment. These scripts use child_process.execSync to run standard development commands like npm view, unzip, and powershell. These are scoped to specific development workflows (e.g., check-versions.js, export-backend.js).
[EXTERNAL_DOWNLOADS]: The check-versions.js script fetches package information from pypi.org and utilizes npm view. These target official package registries to verify dependency versions against known safe versions.
[CREDENTIALS_UNSAFE]: The skill explicitly instructs developers to avoid hardcoding secrets. It mandates the use of sdk_client.secrets.get("KEY") for accessing sensitive data and provides a framework for managing secrets via dedicated MCP tools. It flags hardcoded API keys as a non-negotiable failure.
[INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing untrusted data via datatables and function inputs. It mitigates this risk by:
Ingestion points: Data enters via sdk_client.database and params in Python functions.
Boundary markers: Uses structured JSON for configuration and parameterized Jinja2 templates for analytics queries to prevent SQL injection.
Capability inventory: Restricts execution to a Python sandbox with a whitelist of allowed modules.
Sanitization: Employs Cerbos for fine-grained access control and validates secret values against JSON schemas.

taruvi-app-developer