The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill acts as a bridge between a live World of Warcraft session and an AI agent, ingesting data from the game environment that should be treated as untrusted.
Ingestion points: The skill reads !Mechanic.lua SavedVariables and provides tool outputs via addon.output, which includes aggregated log buffers from any registered addon, performance metrics, and Lua error reports via !BugGrabber (found in SKILL.md and references/ingame-modules.md).
Boundary markers: The documentation mentions escaping command output for HTML rendering in render.js, but does not specify boundary markers or instructions to ignore embedded commands when this data is processed by the AI agent or passed to tools like research.query (found in references/dashboard.md).
Capability inventory: The skill has significant capabilities including executing registry commands via mech call, writing to the filesystem via lua.queue (which writes to MechanicQueue.lua), and performing git operations (commit, tag) via mech release (found in references/cli-commands.md).
Sanitization: While HTML escaping is performed for the dashboard, there is no evidence of sanitization for data being interpolated into agent instructions.
[EXTERNAL_DOWNLOADS]: The mech setup command is documented to download "checksum-verified dev tools" including Lua tools like luacheck, stylua, and busted. While the documentation claims these are verified, the source URLs are not explicitly defined in the analyzed files, representing a dependency on external infrastructure for the tool's core functionality (found in references/cli-commands.md).
[COMMAND_EXECUTION]: The skill provides the mech call command which allows the execution of any registered command in the hub's registry, including mutations. It also provides the lua.queue command, which allows the injection and eventual execution of Lua code within the World of Warcraft game client (found in references/cli-commands.md and SKILL.md).
[CREDENTIALS_UNSAFE]: The documentation mentions the use of GEMINI_API_KEY for the research.query command and suggests storing it in .env files or the user's home directory (~/.mechanic/.env). While this is a standard practice for secret management, the exposure of this key to an agent that also processes untrusted game logs increases the risk of exfiltration via indirect prompt injection (found in references/dashboard.md).

k-mechanic