The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructs the agent to keep API credentials hidden from its own context and the user chat. This is a deliberate security design to prevent the model from accidentally leaking or accessing the sensitive API key, rather than a malicious attempt to bypass safety guidelines.\n- [COMMAND_EXECUTION]: A helper script executes the system open command to launch the Roblox credentials dashboard. The operation uses a hardcoded, verified URL and lacks user-controllable input in the execution path, minimizing the risk of command injection.\n- [EXTERNAL_DOWNLOADS]: The skill fetches the official Roblox OpenAPI specification from create.roblox.com to validate API calls. The implementation includes strict host checking, size limits, and blocks redirects to ensure the integrity of the external data.\n- [CREDENTIALS_UNSAFE]: The skill follows security best practices by reading API keys from environment variables instead of hardcoding them. It also includes a redaction mechanism that filters all network outputs for the API key to prevent leakage into logs or the user interface.

roblox-open-cloud