The Agent Skills Directory

[SAFE]: The skill implements strong security practices for P2P networking, including the use of CSPRNG-based room codes and explicit consent flows for sharing IP addresses over WebRTC.
[SAFE]: The scripts/p2p_room.js module includes comprehensive input sanitization helpers such as cleanName, cleanId, and clampNumber. These are designed to process untrusted data from remote peers safely and prevent common injection attacks.
[INDIRECT_PROMPT_INJECTION]: The skill establishes an attack surface for indirect prompt injection by processing WebRTC messages from remote peers. This is mitigated through documented best practices and provided sanitization logic in references/security.md and scripts/p2p_room.js.
Ingestion points: Untrusted data enters the agent context through the _onData and _onFastData methods in scripts/p2p_room.js via WebRTC data channels.
Boundary markers: Documentation in references/security.md explicitly mandates using textContent and sanitizing all incoming peer strings.
Capability inventory: Limited to WebRTC communication and configuration fetching; no broad shell or file system access is requested.
Sanitization: Robust sanitization functions are provided for names, IDs, numbers, and enums.
[DYNAMIC_EXECUTION]: The test script scripts/test_p2p_room.mjs uses dynamic import() to load a local module path provided via command-line arguments. This is a standard pattern for a standalone test runner.
[EXTERNAL_DOWNLOADS]: The loadIce function in scripts/p2p_room.js fetches ICE configuration from a remote URL provided by the developer. The skill correctly implements sanitization for the returned configuration data to prevent exploitation of the configuration endpoint.

harmony-p2p-multiplayer