The Agent Skills Directory

[SAFE]: The skill provides a highly structured and professional development framework. It contains detailed reference guides for multiple languages (C, C++, Go, Java, Python, Rust, etc.) and focuses on software quality, performance, and security best practices.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted user input during requirement gathering and code implementation phases.
Ingestion points: User-provided functional requirements in reference/requirement.md and source code implementation in reference/implementation.md, reference/review.md, and reference/bug-fix.md.
Boundary markers: The skill employs structured markdown templates (e.g., Given-When-Then, 修订记录) and a segmented five-step workflow to help distinguish user-provided data from system instructions.
Capability inventory: The skill is authorized to write documentation to the local docs/ directory and suggests running standard development tools like compilers (clang, gcc), test runners (npm test, pytest), and linters (eslint, ruff).
Sanitization: The skill relies on its structured process and the AI agent's internal safety filters to prevent injection attacks; no explicit prompt-level escaping is defined.
[CREDENTIALS_UNSAFE]: Several guides (e.g., reference/review-kit/guides/security-review-guide.md and reference/review-kit/guides/java.md) contain a hardcoded API key pattern (sk_live_12345). However, this is used exclusively as a 'Bad' example for educational purposes to illustrate insecure practices during code review and does not represent a leaked credential.

dev-workflow