The Agent Skills Directory

[COMMAND_EXECUTION]: The script submit.py uses subprocess.run to invoke the gcloud CLI. This is a legitimate use case for retrieving secret values from Google Cloud Secret Manager, a secure and standard practice for managing credentials in enterprise environments.
[DATA_EXPOSURE]: The skill includes comprehensive sanitization logic in submit.py. The sanitize_message and sanitize_diagnostic functions proactively redact credentials (Slack tokens), full URLs that appear to contain query-string secrets, and email addresses. It also implements Slack-specific protections like inserting zero-width characters (\u200b) to prevent accidental mentions or command triggers.
[CREDENTIALS_UNSAFE]: The skill follows security best practices by not hardcoding credentials. It attempts to read the Slack webhook URL from an environment variable (SUGGESTION_BOX_SLACK_WEBHOOK_URL) or retrieves it at runtime from a configured Secret Manager secret. This prevents sensitive tokens from being stored in the source code.
[EXTERNAL_DOWNLOADS]: The skill communicates with a well-known service (Slack) via official webhooks. The URL is restricted to the hooks.slack.com domain, and communication is performed over HTTPS with proper timeout and error handling.

suggestion-box