The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses a high attack surface for indirect injection as it is designed to ingest and process arbitrary website content, DOM structures, and external shader definitions.
Ingestion points: scripts/fetch-rendered-dom.mjs (scouts external URLs provided by users), references/unicorn-studio.md (fetches data from Firestore and GCS), and references/shaders-com.md (interacts with platform-specific APIs).
Boundary markers: The skill employs a structured 'Truth Label' system (SOURCE, PARTIAL, GUESS) and a gated state machine (e.g., TARGET_LOCK_GATE) to enforce rigor in agent reasoning and differentiate between extracted evidence and assumptions.
Capability inventory: The agent has access to network tools (curl), browser automation (Playwright), and local file system operations to store evidence and generated code.
Sanitization: Instructions explicitly forbid 'compensation tuning' to mask evidence gaps and require documenting all unknowns in a known-gaps.md file.
[DYNAMIC_EXECUTION]: The skill performs dynamic code generation by synthesizing local JavaScript and GLSL/WGSL modules based on captured external evidence.
Evidence: references/replay-policy.md and references/three-shader-reconstruction.md provide detailed instructions and templates for the agent to generate mount/unmount lifecycle handlers and Three.js shader injections based on runtime data traces.
[COMMAND_EXECUTION]: The skill includes local scripts that execute shell commands and launch browser processes for diagnostic purposes.
Evidence: scripts/scan-bundle.sh uses grep to analyze JavaScript bundles for framework signatures. scripts/fetch-rendered-dom.mjs uses playwright to drive a headless Chromium instance to capture DOM and network metadata.
[UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill references and downloads external tools and data definitions necessary for shader reconstruction.
Evidence: scripts/fetch-rendered-dom.mjs requires the installation of the playwright Node.js package. references/capture-backends.md describes injecting Spector.js from a CDN into the target page. references/unicorn-studio.md and references/shaders-com.md outline procedures for fetching encoded shader definitions from Google Cloud Storage and platform APIs. These resources are generally from well-known providers (Google, jsDelivr) and are documented neutrally.

shader-extract