The Agent Skills Directory

[SAFE]: The skill serves as a legitimate configuration utility for OrchestKit, providing a guided setup for plugin features and security controls.
[SAFE]: The static analysis detection regarding data exfiltration is a false positive. The referenced exfiltration domains (e.g., webhook.site, pastebin.com) are explicitly listed within a deniedDomains configuration array in references/operator-scope-settings.md. This is part of a recommended security policy designed to prevent exfiltration when the Claude Code sandbox is enabled.
[SAFE]: The skill actively encourages security hardening by providing templates and instructions for users to deny access to sensitive credential files (such as .ssh, .aws/credentials, and .env files) and environment variables.
[SAFE]: References to external packages (e.g., MCP servers installed via npx) are transparently documented and consistent with the platform's extensible architecture for Model Context Protocol integrations.
[SAFE]: The session telemetry feature is a functional observability tool that is opt-in, requires explicit user configuration of a webhook URL, and uses HMAC-SHA256 signatures for secure communication.

configure