The Agent Skills Directory

[SAFE]: The skill implements a secure credential-handling pattern for Temporal API keys. It provides the user with a local script to execute in their own terminal, which manages the key locally (writing to CLI config and Secret Manager) so that secret material is never shared with or processed by the AI agent.
[SAFE]: All external dependencies, including SDK packages for multiple languages and infrastructure-as-code modules, are sourced from official, verified repositories and registries belonging to Temporal Technologies (temporalio).
[SAFE]: The skill adheres to security best practices by instructing users to store sensitive credentials in AWS Secrets Manager or GCP Secret Manager rather than using plaintext environment variables for production deployments.
[SAFE]: The provided CloudFormation and Terraform templates for IAM roles are properly scoped to follow the principle of least privilege, restricting access specifically to the resources required for Worker invocation and resizing.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a data ingestion surface as it reads external data from AWS CloudWatch logs, GCP Cloud Logging, and Temporal Workflow history for diagnostic purposes (as seen in references/aws-lambda/diagnostics.md and references/gcp-cloud-run/diagnostics.md).
Ingestion points: Cloud provider log streams and Temporal server metadata.
Boundary markers: The instructions do not define specific delimiters for parsing log content.
Capability inventory: The agent has access to powerful CLI tools such as aws, gcloud, temporal, and terraform.
Sanitization: No explicit logic is provided to sanitize log data before analysis. (Internal severity LOW, dropped to SAFE as this is essential to the primary operational purpose of the skill).

temporal-serverless