The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-provided Minecraft add-on files (JSON manifests, entity definitions, blocks, etc.) which act as ingestion points for external data into the agent's context. A malicious project could contain hidden instructions within these files to influence the agent's behavior during the debugging process.
Ingestion points: scripts/validate-summary.mjs and scripts/add-missing-names.mjs read multiple JSON files from the user's project folder.
Boundary markers: No explicit delimiters or warnings are used when the content of these files is presented to the agent.
Capability inventory: The skill utilizes file system operations (read/write) and subprocess execution (spawnSync) as part of its core functionality.
Sanitization: While the scripts parse JSON and strip comments, they do not sanitize the data against potential prompt injection attacks before the agent processes the validation results.
[COMMAND_EXECUTION]: The script scripts/validate-summary.mjs executes external commands to perform validation tasks.
Evidence: The script uses spawnSync to execute the Minecraft Creator Tools CLI. It defaults to using npx -y @minecraft/creator-tools@latest but can be overridden by the MCT_CLI environment variable.
Context: This execution is part of the intended functionality of the skill, leveraging official vendor tooling for Minecraft add-on development.
[EXTERNAL_DOWNLOADS]: The skill fetches and executes the latest version of the Minecraft Creator Tools utility from the npm registry.
Evidence: SKILL.md and scripts/validate-summary.mjs contain instructions to run npx -y @minecraft/creator-tools@latest.
Context: The download targets an official tool from a well-known service (npm) provided for Minecraft creators.

debug-addon