The Agent Skills Directory

[SAFE]: The skill consists entirely of Markdown documentation and TypeScript code examples designed for educational purposes. There is no executable logic shipped within the skill itself.
[PROMPT_INJECTION]: While the static analysis hints flagged potential prompt injection patterns in references/prompt-injection-defense.md, these are used strictly as illustrative examples of malicious patterns to defend against (e.g., teaching the agent how to recognize 'Ignore previous instructions'). The intent is defensive and educational, not offensive.
[CREDENTIALS_UNSAFE]: The skill promotes secure secret management, recommending the use of environment variables and CI/CD tools like gitleaks to prevent credential exposure. No hardcoded secrets were found in the examples.
[DATA_EXFILTRATION]: The skill provides architectures for preventing data leakage, such as server-side scrubbing of AI streams and sandboxed fetching of external content. It does not perform any network operations itself.
[INDIRECT_PROMPT_INJECTION]: The skill explicitly documents the risks of indirect injection and provides remediation strategies, such as using boundary markers and 'Guardian' models to isolate untrusted data.

secure-ai