The Agent Skills Directory

[PROMPT_INJECTION]: The skill describes tools that ingest external JSON-based map documents, which creates a theoretical surface for indirect prompt injection if an agent processes malicious data embedded in those documents. However, the skill provides extensive mitigation strategies.
Evidence: SKILL.md and references/vesperfall-implementation.md define document schemas and logic for importing local storage drafts and external files.
Mitigation: The instructions explicitly mandate strict schema validation, coordinate bounds checking, manifest matching, and the rejection of unknown entity kinds, effectively hardening the data ingestion boundary.
[COMMAND_EXECUTION]: The skill references standard development and testing commands intended for the local development environment.
Evidence: references/vesperfall-implementation.md lists verification commands such as npm run build, npm test, and node --import tsx --test.
Context: These are routine operations for a developer-oriented skill and do not involve piped remote execution or unknown sources.
[DATA_EXFILTRATION]: The skill provides best-practice guidance for managing production access controls and session security.
Evidence: SKILL.md and references/vesperfall-implementation.md advise using deployment secrets for passwords and IP allowlists, specifying that signing materials must never be bundled, logged, or exported. It also mandates the use of secure, HTTP-only, strict same-site cookies.

build-game-map-editor