The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill documents a system for ingesting and processing untrusted JSON data from external sources.
Ingestion points: Processes JSON payloads via top-bar file imports and ?share=<id> URL parameters as described in SKILL.md.
Boundary markers: Implements an 'Exclusion list' (using regex patterns like /^tinyworld:ai:key:/) to prevent sensitive keys from being processed or saved.
Capability inventory: Local scripts (tools/dev-server.js) can write to the repository root, and the application state is modified at runtime via applyState().
Sanitization: Utilizes regex filtering for credentials and coordinate clamping for UI panels and camera settings.
[COMMAND_EXECUTION]: Development and build scripts are used to manage the project state and deployment.
The 'Save Defaults' pipeline triggers tools/dev-server.js to write configuration to tinyworld-defaults.json on the local file system.
Includes operational scripts such as publish.sh, tools/check.js, and tools/smoke-static.js for project maintenance.
[DATA_EXFILTRATION]: Facilitates the transfer of application data to cloud services as part of its core functionality.
Uploads world state data to Netlify Functions at /api/builds and /api/share for persistence and sharing.
Utilizes PartyKit for real-time multiplayer presence synchronization.

tinyworld-runtime-state