The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The reference implementations in references/nodejs-encryption-library.md and references/python-cryptography-implementation.md include hardcoded placeholder passphrases such as "top-secret" and "passphrase". While intended as examples, these represent a security risk if used in production code.
[DATA_EXFILTRATION]: The references/tlsssl-configuration.md file contains examples that read sensitive local files, specifically private-key.pem. This demonstrates a pattern of accessing sensitive data which, while appropriate for TLS configuration, constitutes a data exposure risk.
[INDIRECT_PROMPT_INJECTION]: The skill's encryption services process external data and files, creating a surface for indirect prompt injection.
Ingestion points: Input strings and file paths passed to encryption/decryption methods in references/nodejs-encryption-library.md and references/python-cryptography-implementation.md.
Boundary markers: No delimiters or safety instructions are used to isolate untrusted data during processing.
Capability inventory: The skill utilizes fs.readFile, fs.writeFile, and Python's open() to perform file operations.
Sanitization: No input validation or sanitization is performed on the data being encrypted or decrypted.
[COMMAND_EXECUTION]: The scripts/security-checklist.sh script takes a user-supplied argument to define an output file path. This allows the script to overwrite arbitrary files on the system if invoked with a malicious path.

data-encryption