Teams need reliable patterns for adding LLMs, retrieval, tools, and agents to production software. This skill provides practical templates and references for RAG, vector search, function calling, observability, and cost control.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "ai-native-development" from https://skillstore.io/skills/ariegoldkin-ai-native-development.md and its manifest at https://skillstore.io/api/skills/ariegoldkin-ai-native-development/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.
Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Most static findings are false positives caused by JavaScript template literals, documentation links, and environment-variable examples in educational material. One real high-risk example uses eval() in a calculator tool, and the agent template should add explicit approval before email or other external side effects.
The agent workflow template defines a send_email tool and examples ask an agent to send reports or summaries, but the template does not include an explicit human approval step before external side effects. This can lead users to copy an agent pattern that performs visible actions without confirmation.
The email tool is a stub, but the surrounding template and examples present autonomous email sending as an intended action. The risk is a design-level safety omission rather than hidden malware.
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The reference implements a calculate tool with eval(expression), which is unsafe if copied into an agent that accepts model-selected or user-controlled input. This is a direct arbitrary code execution pattern in an educational example.
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
AI Agent Hub. (2026). ai-native-development security audit report (audit version 11) [Author version 1.0.0]. Skillstore. https://skillstore.io/skills/ariegoldkin-ai-native-development/audits/11
BibTeX citation
@techreport{ai-agent-hub-ariegoldkin-ai-native-development-2026,
author = {AI Agent Hub},
title = {ai-native-development security audit report (audit version 11)},
institution = {Skillstore},
year = {2026},
number = {11},
url = {https://skillstore.io/skills/ariegoldkin-ai-native-development/audits/11},
note = {Author version 1.0.0}
}
CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "ai-native-development security audit report (audit version 11)"
version: "1.0.0"
type: report
authors:
- name: "AI Agent Hub"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/ariegoldkin-ai-native-development/audits/11"
identifiers:
- type: other
value: "skillstore:ariegoldkin-ai-native-development:audit:11"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this scoreEvidence Confidence: Medium
45
Architecture
100
Maintainability
87
Content
71
Community
78
Spec Compliance
What You Can Build
Prototype a support RAG assistant
Use the retrieval and citation patterns to design a grounded chatbot for product documentation or internal knowledge bases.
Plan an agentic workflow
Apply the ReAct and multi-agent examples to break complex tasks into tool-backed agent steps with clear limits.
Prepare AI features for production
Use the observability and cost guidance to add tracing, budget checks, quality evaluation, and debugging workflows.
Try These Prompts
Choose a retrieval architecture
Help me choose a RAG architecture for my application. My data sources are [describe sources], users ask [describe questions], and my constraints are [latency, cost, privacy]. Recommend chunking, retrieval, and vector database choices.
Implement a grounded Q&A flow
Use this skill to outline a grounded Q&A flow with citations. Include ingestion, embeddings, retrieval, prompt construction, answer generation, and validation steps for [application context].
Review an agent tool design
Review this proposed agent tool list for safety and reliability: [paste tools]. Identify missing schemas, approval gates, validation needs, and iteration limits before implementation.
Design production monitoring
Design a production observability plan for an AI application that uses [model], [retrieval system], and [tools]. Include metrics, traces, evaluations, cost alerts, failure modes, and dashboards.
Best Practices
Start with a narrow RAG use case and evaluate answer quality before expanding scope.
Add explicit approval for tools that send messages, change data, or call external systems.
Track token usage, latency, errors, and answer quality from the first production test.
Avoid
Do not copy examples with eval or unrestricted tool execution into production.
Do not place API keys, private data, or hidden instructions inside prompts.
Do not rely on vector search alone when exact keyword or metadata filters are required.
Frequently Asked Questions
Is this skill mainly for Claude, Codex, or Claude Code?
It supports Claude, Codex, and Claude Code workflows. The examples also discuss provider-neutral AI application patterns.
Does it create a complete RAG application automatically?
No. It provides templates, references, and checklists that developers adapt to their application and infrastructure.
Can I use the examples in production?
Use them as starting points only. Review security, provider configuration, error handling, and approval gates before production use.
What topics does the skill cover?
It covers embeddings, vector databases, RAG, function calling, agents, streaming, cost optimization, and observability.
Does this skill require external services?
Some examples use external model providers and vector databases. You can adapt the patterns to local or self-hosted alternatives.
What should I review first for safety?
Review tool execution, secret handling, prompt injection defenses, user data boundaries, rate limits, and human approval requirements.