The Agent Skills Directory

[OBFUSCATION]: The file 62-cctv-truman.js utilizes 4-space indentation specifically to evade the duplicate-declaration guard in tools/check.js, which is designed to scan 2-space declarations. This is an explicit attempt to bypass static analysis tools.
[DYNAMIC_EXECUTION]: The QA documentation describes procedures for dynamically appending scripts to the DOM and evaluating modules via eval, which are techniques that can be leveraged for arbitrary code execution during the testing phase.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external API endpoints (/api/worlds) and iterates through world matrices, presenting a potential surface for injection. 1. Ingestion points: scripts/landing-feed.js and 63-cctv-placement.js. 2. Boundary markers: No delimiters or ignore instructions are specified for the fetched data. 3. Capability inventory: Subprocess calls via npm and shell execution via ./publish.sh. 4. Sanitization: No sanitization or validation of external input is described in the provided documentation.
[COMMAND_EXECUTION]: The skill references the execution of shell scripts and NPM commands as part of its deployment and testing workflow, including ./publish.sh, npm run check, and npm run smoke.

tinyworld-cctv-truman