The Agent Skills Directory

[SAFE]: The skill serves as documentation for the assistant-stream library. It does not contain executable malicious scripts or instructions designed to override AI safety guardrails.
[EXTERNAL_DOWNLOADS]: The skill references several external packages and resources, all of which are from trusted or well-known sources:
Vendor Packages: assistant-stream, @assistant-ui/react, @assistant-ui/react-data-stream, @assistant-ui/ai-sdk, and @assistant-ui/react-langgraph are official libraries provided by the skill author (assistant-ui).
Well-Known Libraries: The skill mentions redis and ioredis for implementing resumable stream stores, which are standard industry tools for data persistence.
Trusted Domains: References to assistant-ui.com, npmjs.com, and pypi.org are legitimate links to documentation and package registries.
[CREDENTIALS_UNSAFE]: The skill demonstrates best practices for credential handling. It uses environment variable placeholders like process.env.REDIS_URL and standard authorization headers (Authorization: Bearer token) in code examples, avoiding the use of hardcoded secrets.
[DATA_EXFILTRATION]: No patterns of unauthorized data exfiltration were found. The network operations described (streaming LLM responses) are the primary intended purpose of the library. The documentation in resumable.md specifically warns about the sensitivity of streamId and provides guidance on binding it to authenticated users to prevent unauthorized access.
[PERSISTENCE]: The "Resumable Streams" feature described in resumable.md is a legitimate architectural pattern for session persistence, allowing clients to resume interrupted byte streams. It is not a persistence mechanism for maintaining unauthorized access to a host system.

streaming