The Agent Skills Directory

[SAFE]: The skill facilitates dynamic code generation of TypeScript and GLSL for video rendering. This process is secured through a multi-layered validation approach. According to references/design-principles.md, the execution environment explicitly blocks dangerous globals such as eval, Function, fetch, process, window, and crypto. Additionally, SKILL.md describes a backend validation process that includes transpilation and AST-based security scanning to ensure generated classes conform to the EffectProcessor and TransitionProcessor interfaces without executing unsafe logic.
[PROMPT_INJECTION]: The skill ingests untrusted data via the prompt parameter in submit_shader and potentially via project metadata retrieved through read_project. However, this data is used to guide a code generation process that is heavily constrained by the aforementioned backend validation and environment sandboxing. The capability to write files or perform network operations is strictly controlled, mitigating the impact of indirect prompt injection.
[DATA_EXFILTRATION]: There are no patterns of data exfiltration or unauthorized file access. The skill's reference documentation explicitly lists network-related APIs (e.g., XMLHttpRequest, WebSocket, fetch) as blocked, ensuring that shaders cannot be used as a vector for sending sensitive project data to external domains.

shader-gen