The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill defines workflows for processing data from external sources, including Roblox API responses and incoming webhook payloads, which presents a surface for indirect prompt injection.
Ingestion points: External data enters the agent context via HttpService:RequestAsync responses and webhook POST payloads as described in references/webhooks-documentation.md.
Boundary markers: The instructions do not explicitly require the agent to use delimiters or specific safety instructions when summarizing or acting upon data retrieved from these external endpoints.
Capability inventory: The skill facilitates network operations through HttpService and automation logic that may be influenced by external inputs.
Sanitization: The skill provides strong security instructions to mitigate risks, specifically mandating the use of Roblox Secrets for authentication and detailed HMAC-SHA256 signature verification for webhooks to ensure payload integrity and authenticity.
[COMMAND_EXECUTION]: The documentation describes the use of the rg (ripgrep) command-line utility for searching local API artifacts.
Evidence: Instructions in references/cloud-reference-json-files.md demonstrate using rg to locate operationId, apiKeyWithHttpService, and scope metadata within the local sources/creator-docs/reference/cloud directory. This usage is restricted to searching documentation files.

roblox-cloud