The Agent Skills Directory

[NO_CODE]: The skill provides a reference implementation in HTML/JavaScript and a standalone Python validation script. Both are designed to run locally or via a simple development server without external code dependencies or dangerous platform integrations.
[COMMAND_EXECUTION]: The provided commands (python3 scripts/validate-city-pack.py and python3 -m http.server) are standard development tasks using the Python standard library. They do not involve shell injection or execution of untrusted remote content.
[DATA_EXFILTRATION]: Network operations described in the documentation (e.g., curl calls to OpenStreetMap and USGS) target well-known, trusted public GIS services. These operations are intended for the user to perform manually or via scripts to acquire city data, and the skill itself does not silently exfiltrate sensitive information.
[INDIRECT_PROMPT_INJECTION]: The skill processes structured GIS data (JSON). The browser-based engine and validator include defensive measures such as resource caps (MAX_CELLS, MAX_FEATURES), vertex limits, and strict schema validation to prevent malformed or malicious data from causing resource exhaustion or unexpected behavior.
[OBFUSCATION]: No obfuscated code, hidden URLs, or suspicious character encoding patterns were found in the skill's instructions, scripts, or assets.
[PRIVILEGE_ESCALATION]: The skill does not request or use administrative privileges. All components are designed to run in a standard user context or within the browser sandbox.

ascii-city-engine