The Agent Skills Directory

[SAFE]: The skill serves as a best-practice guide for developers working with an API Gateway. It correctly identifies that authentication termination and identity validation are handled by the platform infrastructure.
[SAFE]: It explicitly mandates security controls to prevent Insecure Direct Object Reference (IDOR) vulnerabilities by requiring that all database queries (SELECT, UPDATE, DELETE) be gated by both the resource ID and the validated X-User-Id header.
[SAFE]: The skill discourages insecure practices, such as services attempting to validate JWTs locally without the proper signing keys or issuing their own tokens, which prevents authentication disagreement between the gateway and the service.
[SAFE]: The guidance regarding identity propagation and CORS is consistent with modern secure microservices architecture and contains no executable code or malicious instructions.

api-management