The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from multiple external sources including search results, 3D model metadata, and video transcripts.
Ingestion points: refs.md (Wikimedia and Openverse search results), study.md (WebSearch and WebFetch results, YouTube transcripts/descriptions), and assets.md (API responses from PolyHaven, ambientCG, and Poly Pizza).
Boundary markers: There are no explicit instructions or delimiters mentioned in the prompts to ensure the agent ignores embedded commands when processing this external data for the project brief or code generation.
Capability inventory: The skill possesses the ability to write project files, execute shell commands (e.g., ffmpeg, yt-dlp, unzip), and generate executable Three.js/React code.
Sanitization: The instructions include manual verification steps (reading licenses and previewing frames), but lack formal sanitization or escaping of the ingested text before it influences the agent's logic.
[EXTERNAL_DOWNLOADS]: The skill downloads 3D models and image references from well-known services and libraries.
Fetches assets from PolyHaven, ambientCG, Poly Pizza, Kenney, and Quaternius.
Gathers reference images from Wikimedia Commons and Openverse.
[COMMAND_EXECUTION]: The skill utilizes several shell commands to process media and improve user workflow.
Media processing: Uses yt-dlp and ffmpeg in study.md to extract information and frames from online videos.
Archive handling: Uses unzip in assets.md to extract downloaded asset packs.
System interaction: Uses platform-specific commands (open, xdg-open, start) in SKILL.md to display generated boards and reference picks to the user for review.

paprika-make