The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill describes how to handle external data from URL parameters, browser messages, and file uploads within a Godot project.
Ingestion points: references/javascript-bridge.md illustrates reading URL parameters via location.search and listening for postMessage events.
Boundary markers: The documentation guides developers to implement origin validation for incoming messages to ensure security boundaries are respected.
Capability inventory: The skill identifies that ingested data could potentially reach sensitive functions like JavaScriptBridge.eval() or be used in file operations.
Sanitization: The skill emphasizes treating all external data as untrusted and provides clear warnings against using such data in dynamic execution sinks without prior validation.
[DYNAMIC_EXECUTION]: The documentation references JavaScriptBridge.eval() for browser interoperability. It includes necessary security warnings to prevent command or script injection by avoiding the use of unsanitized external strings within the eval call.

web-export