The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill explicitly warns against hardcoding API tokens and demonstrates the use of environment variables (REPLICATE_API_TOKEN) for authentication. It provides clear 'Bad' vs 'Good' examples to educate the user on secure secret management.
[EXTERNAL_DOWNLOADS]: The skill references the official replicate package from the npm registry. This is a well-known, legitimate SDK for the Replicate platform and is required for the skill's primary purpose.
[COMMAND_EXECUTION]: The documentation includes standard package installation commands (npm install replicate) which are routine and necessary for the intended development workflow.
[INDIRECT_PROMPT_INJECTION]: The skill documents how to process outputs from AI models, which are untrusted data sources. However, it emphasizes security-critical patterns such as validateWebhook() to ensure that incoming data is verified and comes from the expected source. It does not provide any patterns that would lead to unsafe execution of model output.
[DATA_EXFILTRATION]: All network operations described in the skill are directed to Replicate's official API infrastructure. There are no patterns suggesting the unauthorized transmission of sensitive user data to third-party or attacker-controlled domains.

ai-infrastructure-replicate