The Agent Skills Directory

[PROMPT_INJECTION]: The skill presents a surface for indirect prompt injection because it processes natural language user ideas to generate executable code.
Ingestion points: User-provided mod descriptions are ingested by the agent to drive the authoring process (defined in SKILL.md).
Boundary markers: The skill contains a 'Non-negotiable boundaries' section in SKILL.md that explicitly forbids the generation of code using unsafe techniques like Harmony patching, reflection, or direct IL manipulation.
Capability inventory: The skill possesses capabilities to generate C# source code (scripts/scaffold.py), compile it using the system's .NET SDK (scripts/build.py), and execute the resulting project via a game launcher (scripts/launch.py).
Sanitization: Sanitization is implemented in scripts/scaffold.py, which validates identifiers like the mod_name using a regular expression (^[A-Za-z_][A-Za-z0-9_]*$) before source code generation. Furthermore, scripts/vanilla_overrides.py includes a _scan_semantic_keys function that actively blocks keys associated with risky practices such as 'harmony', 'reflection', and 'publicizer'.
[COMMAND_EXECUTION]: Several automation scripts execute system commands using the subprocess module.
scripts/launch.py uses subprocess.Popen to launch the game executable and the system open command on macOS.
scripts/build.py uses subprocess.run to call the dotnet build system for compilation.
scripts/acquire_sprite.py uses subprocess.run to interact with the vofy CLI tool and local image processing scripts.
[EXTERNAL_DOWNLOADS]: The scripts/gen_sprite.py tool performs external network requests using urllib.request to connect to user-configured AI image generation backends. This is used to obtain assets for the generated mods based on user prompts.

modmaker