The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill implements strong defensive practices for secret management. It explicitly forbids hardcoding SDK keys in source code and mandates a blocking consent step (D7) where the user must choose how to handle secrets (e.g., manual setup, .env file, or fetching via MCP). It further instructs the agent to ensure .env files are added to .gitignore to prevent accidental credential leakage.
[COMMAND_EXECUTION]: The skill directs the agent to execute standard package manager commands (e.g., npm install, pip install) and build scripts. It includes specific guardrails (D8) requiring user approval for any modifications to non-LaunchDarkly dependencies or broader project resolution strategies.
[INDIRECT_PROMPT_INJECTION]: The skill interacts with existing repository files and follows instructions from internal recipe files. This creates a standard attack surface for indirect prompt injection, but the skill mitigates this through structured decision points and explicit verification steps. The severity is internally assessed as LOW.
[EXTERNAL_DOWNLOADS]: The skill fetches documentation and signup links from LaunchDarkly's official domains (launchdarkly.com). These are recognized as trusted vendor resources for this skill and do not present a security risk.

apply