The Agent Skills Directory

[SAFE]: Credential Handling Best Practices. The skill instructions in SKILL.md and agents/openai.yaml strictly prohibit the agent from handling sensitive credentials like passwords, tokens, or authorization codes. It mandates that authentication (tiangong-lca auth login) be performed by a human in a trusted terminal to prevent credential theft or exposure.\n- [SAFE]: Secure Command Execution. The skill uses Node.js spawnSync to execute the tiangong-lca CLI tool. This is a standard and safe way to wrap CLI functionality, and the commands are restricted to the vendor's own auditing and QA tools (e.g., tiangong-lca qa process). The scripts act as controlled wrappers for these vendor-owned resources.\n- [SAFE]: Data Processing Integrity. The skill operates on structured lifecycle assessment data (JSON/JSONL) and relies on deterministic CLI outputs for its findings. The instructions explicitly state that semantic LLM reviews are handled by a separate Foundry curation gate, which minimizes risks associated with processing potentially malicious external data strings within the skill's primary execution context.

lifecycleinventory-review