The Agent Skills Directory

[SAFE]: No malicious patterns or security risks were detected. The skill's implementation aligns with its described functionality for creating and managing portfolio sites.
[COMMAND_EXECUTION]: The skill triggers the edgeone-pages-deploy tool to handle the final deployment of generated files. This is a legitimate use of platform-provided automation tools.
[EXTERNAL_DOWNLOADS]: Communicates with the DeepSeek API (api.deepseek.com) for optional AI features. DeepSeek is a well-known AI service provider, and this network activity is necessary for the skill's primary purpose.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: User-entered project details in admin.html and visitor questions in assistant.js.
Boundary markers: Uses clear labels like '- 项目名称:' in prompt templates to separate data from instructions.
Capability inventory: Network access to DeepSeek API and project deployment capabilities via tool chaining.
Sanitization: Employs escapeHtml for UI output rendering to prevent XSS, although it does not include specific prompt injection filtering for LLM inputs.
[SAFE]: Implements secure secret management by prioritizing environment variables for the JWT_SECRET and DEEPSEEK_API_KEY, and uses unique salts for password hashing.

portfolio-flow