The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses shell commands to interact with its helper scripts (api.js, inject-key.js, exec-token.js). These commands are well-scoped to the skill's purpose and include sanitization logic to prevent secret leakage in output. The exec-token.js script allows executing third-party CLI tools, but it is explicitly designed to substitute keys securely via placeholders, and its output is passed through a sanitization filter.
[DATA_EXFILTRATION]: The skill implements strict security guidelines to prevent data exposure. It uses a dedicated sanitize.js module to redact sk- tokens, Bearer tokens, and sensitive field values from command outputs and file scans. The copy-key.js script writes directly to the system clipboard via a pipe, ensuring the real key never enters the AI's environment.
[CREDENTIALS_UNSAFE]: The skill handles credentials using best practices. It instructs users to store sensitive environment variables (NEWAPI_ACCESS_TOKEN, NEWAPI_USER_ID) in their shell environment or .env files (with recommendations for .gitignore). It never displays full API keys in the chat, instead providing a 'scan' mode to redact existing secrets when inspecting configuration files.
[EXTERNAL_DOWNLOADS]: The skill references official documentation and repositories from known sources (github.com/QuantumNous/new-api, newapi.ai). These references are used for user help and API documentation retrieval and do not involve downloading or executing untrusted code.

newapi