The Agent Skills Directory

[Secure Credential Management]: The skill explicitly demonstrates and recommends using environment variables (e.g., process.env.GITHUB_TOKEN) and Azure Managed Identity for authentication. It includes 'Incorrect' examples specifically to warn against hardcoding API keys in source code.
[Tool Permission Controls]: The SDK provides built-in security hooks like onPreToolUse, which allows developers to implement logic for approving or denying specific tool executions (e.g., blocking shell access). This is a strong security feature for managing agent capabilities.
[External Tool Integration]: The skill demonstrates how to integrate with Model Context Protocol (MCP) servers, including local execution via npx. While this involves running external code, it is presented as a standard integration pattern for extending agent functionality.
[Data Sanitization Hooks]: It provides examples for using onPostToolUse hooks to redact sensitive information from tool results before they are processed by the model, which helps prevent data exposure.
[Indirect Prompt Injection Surface]: As an AI development SDK, applications built with it are naturally subject to indirect prompt injection if they process untrusted data. The skill includes hooks for prompt modification and context injection that can be used to implement safety boundaries.

copilot-sdk