The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill documents the attack surface where untrusted data from a web interface (NUI) enters the game client context via RegisterNUICallback and SendNUIMessage. However, it provides strong defensive guidance, including mandatory input validation on the client and re-validation on the server before state changes.
Ingestion points: Data enters the agent's logic through NUI callbacks and message listeners defined in rules/nui-callbacks.md and rules/setup.md.
Boundary markers: The instructions explicitly state that developers must validate all inputs and never trust UI-sent prices or IDs.
Capability inventory: The skill's scope is restricted to UI rendering and game interaction natives; it does not request capabilities for arbitrary shell execution or external network exfiltration to non-game domains.
Sanitization: Examples include Lua string sanitization (gsub) and type checking in rules/nui-callbacks.md and rules/best-practices.md.
[EXTERNAL_DOWNLOADS]: The skill references standard build tools and libraries such as Vite, React, and Vue in rules/setup.md. These are well-known development tools and their use is documented neutrally as a recommendation for modern UI development.
[COMMAND_EXECUTION]: The skill mentions shell commands for initializing projects (e.g., npm create vite@latest) and debugging (e.g., nui_devTools). These are standard developer operations and do not involve silent or malicious execution.

fivem-nui