The Agent Skills Directory

[CREDENTIALS_SAFE]: The skill requires a DOUBAOYA_API_KEY to function. The instructions and scripts (scripts/lib/context.mjs, scripts/lib/output.mjs) contain explicit safeguards and hard rules to prevent the agent from printing or logging the API key. Secrets are retrieved from environment variables as per industry standard practices.
[EXTERNAL_DOWNLOADS]: The skill communicates exclusively with its official service domain https://doubaoya.com. These network operations are intended for the skill's primary purpose of fetching new media data and are directed to the vendor's own infrastructure.
[COMMAND_EXECUTION]: The skill includes a shim and CLI mechanism (scripts/dby.mjs, references/dby-shim.mjs) that uses node:child_process to spawn its own logic. This is a standard implementation for multi-script agent skills and does not involve arbitrary command execution from untrusted sources.
[DATA_EXPOSURE]: The skill reads and writes local JSON files (scripts/lib/commands/doc.mjs, material.mjs, profile.mjs) to manage local configurations, profiles, and drafts. These operations are scoped to the skill's directory and the user's explicit commands.
[OBFUSCATION]: The code uses standard Node.js patterns and clear logic. ANSI escape codes for terminal coloring and Base64 encoding for Proxy-Authorization are used correctly and are not for malicious concealment.

dby-api