The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill enables the agent to download external source code from potentially untrusted sources via the vg fork command. This content is then processed with build tools, creating a surface where malicious instructions within the project files could influence the agent's actions.
Ingestion points: vg fork <source-slug> in SKILL.md downloads source code from external slugs defined by other users.
Boundary markers: Absent. The skill lacks instructions to delimit the untrusted content or warn the agent about potentially embedded instructions.
Capability inventory: The skill uses npm install, npm run, and vg deploy to process and execute scripts from the downloaded source files.
Sanitization: Absent. No verification or sanitization steps are provided before the agent executes the downloaded code.
[OBFUSCATION]: A hidden control character (Soft Hyphen U+00AD) is present in the filename .vibedgamesignore within the markdown text. While likely a formatting artifact, such characters can be used to bypass simple text filters.

fork