The Agent Skills Directory

[SAFE]: The skill serves as a comprehensive guide for micro-app development. It documents the use of official @xgent packages and standard development workflows (Vite, React, Bun) without any suspicious behavior.
[DATA_EXFILTRATION]: The instructions explicitly forbid storing sensitive tokens in localStorage and mandate the use of the sdk.getToken() method and sdk.callService proxy. This ensures that micro-apps follow zero-trust principles and that credentials remain within the SDK's secure context.
[COMMAND_EXECUTION]: The skill mentions platform-specific CLI tools like xgent-app-release for publishing applications. These tools are part of the vendor's ecosystem and their use is documented as part of the intended deployment pipeline.
[INDIRECT_PROMPT_INJECTION]: The skill describes the ingestion of app.manifest.json and AclManifest data. It provides mitigation strategies, such as strict validation of URL prefixes for notifications and breadcrumbs, ensuring that external configuration data does not lead to UI spoofing or unauthorized navigation.

portal-micro-app