The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external JSON files for achievement and leaderboard definitions, which represents a potential injection surface.
Ingestion points: Local JSON files (achievement.json, leaderboard.json) are read and synced using gpc games achievements create/update --file commands.
Boundary markers: The instructions lack explicit boundary markers or warnings for the agent to ignore instructions embedded within the JSON content (e.g., in name or description translation fields).
Capability inventory: The skill utilizes the gpc CLI to perform authenticated write operations to Google Play Games Services and local configuration files (.gpcrc.json).
Sanitization: The skill does not describe specific sanitization steps for the data contained within the JSON files before it is processed by the CLI tool.
[COMMAND_EXECUTION]: The skill includes a detection script (scripts/detect_gpc.mjs) that executes shell commands to determine the environment state.
Evidence: Uses node:child_process.execSync to run gpc --version, gpc auth status, and gpc config get. These commands use static strings and are restricted to environment discovery.

gpc-games