The Agent Skills Directory

[SAFE]: The skill consists entirely of markdown documentation and evaluation criteria. There are no executable scripts, shell commands, or tool definitions included within the skill package.
[INDIRECT_PROMPT_INJECTION]: The skill provides instructions for processing external data, which creates an inherent attack surface, though it lacks the tools to exploit it.
Ingestion points: External APIs, provider models, and webhooks as referenced in SKILL.md and references/webhooks-reconciliation.md.
Boundary markers: The guidelines explicitly mandate the use of anti-corruption boundaries and mapping external IDs to internal models to prevent vendor model leakage (see references/boundary-mapping.md).
Capability inventory: The skill contains no scripts, binaries, or automated tool capabilities.
Sanitization: Verification of webhook authenticity is specified as a requirement to be handed off to security specialists in references/webhooks-reconciliation.md.
[DATA_EXFILTRATION]: The instructions in SKILL.md specifically warn the agent to avoid logging secrets or sensitive payloads when observing external integrations.

integration-engineering