The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill serves as an interface for the trtc-push-mcp workflow engine, passing user prompts to external tools. It includes several security-conscious design choices to mitigate risks associated with untrusted data:
Ingestion points: User input is ingested via the user_prompt parameter in the get_workflow_state and complete_workflow_step tools as described in references/workflow-protocol.md.
Boundary markers: The skill explicitly instructs the agent not to place user prompts into the session context to avoid leakage into state tokens. It also mandates that state_token values be treated as opaque, non-modifiable blobs.
Capability inventory: The skill facilitates file writing (via code templates), project structure detection, and external tool calls through the MCP framework.
Sanitization: The skill notes that 'quality events and local desensitization are handled by the MCP', indicating a layer of filtering for external content.
[EXTERNAL_DOWNLOADS]: The skill references several external dependencies required for TIMPush integration:
It documents the setup of the vendor-owned MCP tool using npx -y @tencent-rtc/trtc-push-mcp@1.
It references well-known mobile development dependencies such as com.tencent.timpush (Maven), com.hihonor.mcs, com.google.gms:google-services, and com.huawei.agconnect.
These resources are either official vendor assets from tencent-rtc or provided by established service providers (Huawei, Google, Honor) for the stated purpose of the skill.
[COMMAND_EXECUTION]: The skill includes instructions for executing build and setup commands, such as pod install, xcodegen generate, and ./gradlew :app:assembleDebug. These are standard development tasks for mobile application integration.
[CREDENTIALS_UNSAFE]: The skill demonstrates a strong security posture regarding secrets. references/hard-rules.md and references/code-templates.md contain mandatory 'red lines' that forbid hardcoding API keys, AppKeys, or SecretKeys in source code, Gradle files, or Info.plist. Instead, it provides templates for using local.properties (Android) and gitignored source files (iOS).

trtc-push