The Agent Skills Directory

[DATA_EXFILTRATION]: The vg generate upload <path> command enables the uploading of local files to the Vibedgames backend server. This functional requirement presents a data exfiltration risk if the agent is prompted to upload sensitive files (e.g., configuration files or private keys) from the local filesystem.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data from external API endpoints via the models, schema, and docs subcommands, which could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: Data enters the agent context through the stdout of vg generate models, vg generate schema, vg generate status, and vg generate docs (SKILL.md, references/full-reference.md).
Boundary markers: None present; the instructions do not include delimiters or warnings to ignore instructions embedded in the API responses.
Capability inventory: The skill possesses capabilities for subprocess execution (vg generate run), file system writes (--download), and network transmission (upload).
Sanitization: There are no documented procedures for sanitizing or validating the JSON/text output received from the remote services.
[EXTERNAL_DOWNLOADS]: The skill documentation recommends installing the vibedgames and @openai/codex packages via npm. While these are associated with the vendor and a well-known service, they represent external dependencies managed at runtime.
[COMMAND_EXECUTION]: The skill's primary functionality is implemented through the execution of the vg generate CLI tool using various subcommands and flags.

generate