The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses bash -c to execute curl commands for API interactions. This pattern is explicitly documented as a workaround for environment-specific issues with pipes and environment variable persistence.
[PROMPT_INJECTION]: The skill processes external data from the DocuSign API, which represents an indirect injection surface.
Ingestion points: API responses describing envelopes, documents, and templates are ingested into the agent context.
Boundary markers: No explicit delimiters are used in the output to separate API data from instructions.
Capability inventory: The skill allows for network requests via curl and local command execution via bash.
Sanitization: Responses are passed through jq, which filters the output to specific, expected JSON fields, effectively sanitizing the data and reducing the risk of malicious content affecting the agent.
[SAFE]: Secret management is handled correctly using the vm0_secrets directive for the DOCUSIGN_TOKEN, preventing the exposure of hardcoded credentials.
[SAFE]: Network operations are directed towards well-known, official DocuSign domains (e.g., account.docusign.com) and authenticated base URIs.

docusign