The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides instructions for downloading test vectors from official NIST domains, such as csrc.nist.gov and pages.nist.gov. These references are neutral and target well-known, trusted governmental repositories for cryptographic validation data.
[COMMAND_EXECUTION]: The documentation includes shell command examples for downloading and verifying the integrity of archives. These commands use secure protocols and are accompanied by instructions to perform SHA-256 digest verification and check for path traversal vulnerabilities during archive extraction.
[DATA_EXFILTRATION]: The skill incorporates clear security guidelines regarding sensitive data, explicitly instructing that secrets (keys, tokens, and credentials) must not be stored in repositories, logs, or shared in chat sessions.
[INDIRECT_PROMPT_INJECTION]: The skill includes a dedicated Python utility (scripts/check-rsp.py) designed to parse and validate the structure of external NIST response files. This utility mitigates injection risks by enforcing strict formatting rules (e.g., hexadecimal checks, required fields) and requiring the rejection of malformed or non-compliant data.

nist-cavp