The Agent Skills Directory

[SAFE]: The skill follows security best practices for web development.
[DATA_EXPOSURE_AND_EXFILTRATION]: No sensitive data exposure or unauthorized network communication. The setLanguage function correctly scopes file fetching to a predefined list of supported locales, preventing directory traversal attacks.
[INDIRECT_PROMPT_INJECTION]: The skill provides explicit guidance on sanitizing untrusted data (player names) by stripping control characters and using safe DOM APIs (textContent) instead of innerHTML, which effectively mitigates XSS risks. Evidence Chain: 1. Ingestion: Language JSON files and Harmony display names. 2. Boundary markers: Explicit instructions to use textContent and DocumentFragment. 3. Capability: Relative fetch calls and DOM manipulation. 4. Sanitization: Stripping Bidi/ZW control characters and length capping.
[DYNAMIC_EXECUTION]: The skill explicitly warns against using dangerous functions like eval or new Function for processing language files or templates.
[OBFUSCATION]: No obfuscated content or hidden payloads were found. The skill actually instructs users on how to detect and remove malicious obfuscation (like zero-width characters) from user-provided strings.

harmony-localization