The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides a script scripts/audit_renderer_features.py and instructions in SKILL.md to run it using python3 to audit local Cargo.toml files. This is a legitimate utility for the skill's purpose of auditing Bevy project configurations and does not involve network access or external command execution.
[DYNAMIC_EXECUTION]: The test file tests/test_audit_renderer_features.py uses importlib.util and exec_module to load and run the audit script during testing. This is a standard and safe practice for local testing of standalone scripts within the development environment.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user data (local Cargo.toml files) which represents a surface for indirect prompt injection.
Ingestion points: The audit function in scripts/audit_renderer_features.py reads a user-supplied manifest file using tomllib.
Boundary markers: Absent. The script's output is directly interpreted by the agent without specific delimiters.
Capability inventory: The script is limited to file reading and TOML parsing via pathlib.Path.read_text and tomllib.loads. It does not perform network operations, subprocess calls, or file writes.
Sanitization: The script uses tomllib for structured parsing and only validates specific Bevy/Rapier feature keys, which significantly limits the potential for instruction injection via the configuration file.

bevy-rendering