The Agent Skills Directory

[SAFE]: The skill enforces excellent engineering practices that improve security and stability. Specifically, it prohibits the use of the any type in TypeScript to maintain compile-time safety and requires the use of unknown with type guards for external data. It also mandates self-verification of code changes using browser-based testing tools and local build checks.
[EXTERNAL_DOWNLOADS]: The skill references official CloudBase SDKs. It recommends installing @cloudbase/js-sdk and @cloudbase/node-sdk via npm, which are official packages from the vendor. It also provides a CDN link for the JS SDK (https://static.cloudbase.net/cloudbase-js-sdk/latest/cloudbase.full.js). These are all legitimate resources belonging to the skill's authoring organization (tencentcloudbase).
[INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it involves the agent reading and interpreting external data such as web page content (via agent-browser) and source code files. However, the skill includes explicit instructions for the agent to follow strict engineering protocols and boundary-checking (e.g., resolving environment IDs before use), which mitigates accidental misinterpretation of data as commands. Given the intended use case for development and debugging, this surface is managed and acceptable.
[SAFE]: The skill explicitly forbids the agent from fetching remote skill markdown or protocol files via HTTP, insisting on using local relative paths. This prevents the dynamic loading of untrusted instructions from external servers.

web-development