The Agent Skills Directory

[DYNAMIC_EXECUTION]: The file references/maple-character-skill-system.md provides a Python code snippet for a 'Skill Calculator' that uses the eval() function to process formula strings. Since the skill instructs the agent to retrieve these formulas from a remote CDN (https://resource-static.msu.io/data/), this pattern creates a risk of arbitrary code execution if the external data source is modified by a malicious actor.\n- [EXTERNAL_DOWNLOADS]: The skill frequently references and instructs the agent to fetch assets and JSON data from an external CDN at https://resource-static.msu.io/data/. While this appears to be the primary data source for the game assets, it represents a dependency on an external domain that is not on the whitelisted trusted lists.\n- [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection because it ingests large amounts of external JSON data from a CDN and via MCP search tools, then uses that data in calculations involving eval() without comprehensive sanitization.\n
Ingestion points: JSON asset files fetched from the msu.io CDN and data returned by the maple-lookup MCP tool.\n
Boundary markers: Absent; the instructions do not specify the use of delimiters or 'ignore' instructions for the external content.\n
Capability inventory: The skill is capable of performing network requests, resolving file paths, and executing code via the eval()-based calculator.\n
Sanitization: The provided Python snippet only performs simple string replacements for basic arithmetic functions and does not implement security validation of the formula string before execution.

maple-make