The Agent Skills Directory

[DYNAMIC_EXECUTION]: The animation capture scripts (play.js, setup.js, and shot.js) utilize eval() to execute code retrieved from a local server. Specifically, they fetch a driver script from http://127.0.0.1:6163/driver.js and execute it to inject control logic into the host page. This activity is restricted to localhost.
[COMMAND_EXECUTION]: The skill includes a setup script (install.sh) that performs standard administrative tasks like creating directories, copying tool scripts, and checking network ports using lsof. These operations are intended for local environment preparation.
[INDIRECT_PROMPT_INJECTION]: The skill uses LLM agents to review animation frames, creating a surface for indirect prompt injection. Untrusted data enters the context via animation sheet filenames and frame content processed in msheet.py and psheet.py. Boundary markers are present in templates/critic-prompt.md via a fixed rubric, but specific 'ignore instructions' warnings are absent. The skill's capability inventory includes shell commands in install.sh and eval() in play.js. No explicit sanitization of external content is performed, but the skill requires human verification of all critic claims as a safeguard.

game-dev-combat-animation