The Agent Skills Directory

[CREDENTIALS_SAFE]: The skill implements strong security measures for handling the DOUBAOYA_API_KEY. Instructions in SKILL.md and README.md explicitly forbid the agent from re-displaying the full key, recommending the use of environment variables and only showing a masked prefix for verification.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data retrieved from social media platforms (Douyin, Xiaohongshu, etc.). While this creates a surface for indirect prompt injection, the skill includes a dedicated content-safety-check capability designed to detect prohibited words and risks, and the agent is instructed to use external data only as source material for synthesis.
[COMMAND_EXECUTION]: The skill includes a Node.js script (scripts/doubaoya.mjs) provided for local testing and agent use. This script is transparent, uses zero external dependencies, and limits its operations to standard HTTP requests to the vendor's API and parsing JSON responses.
[SAFE]: The skill provides clear documentation regarding retired features (the mera service) to prevent the agent from providing inaccurate or hallucinatory information when requested to access personal data that is no longer available.

doubaoya