The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill utilizes Node.js module.registerHooks and dynamic import() to load and execute TypeScript files from the analyzed project during the verification process. This is used in scripts/lib/app-modules.mjs to strip types and resolve path aliases. While essential for analyzing the game's logic (e.g., checking if the game module agrees with its declaration), it allows for the execution of code from the project being analyzed within the Node.js context.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data from the target project (source files, configuration, and TypeScript modules). This creates an attack surface where a malicious project could attempt to influence the agent's behavior or execute code during the verification stage.
Ingestion points: Project source files read in usedKeys and checkPlaceholders (scripts/lib/game-checks.mjs), and app-settings.ts loaded via import() in scripts/lib/app-checks.mjs.
Boundary markers: The skill uses maskComments when performing static scans for catalog keys and placeholders to ignore instruction-like content in comments.
Capability inventory: The skill possesses the capability to write files (writeFileSync in scaffold-game.mjs), execute local scripts (spawnSync in check-lib.mjs), and execute code via import().
Sanitization: Static analysis includes comment masking, but dynamic loading of project modules lacks sanitization against malicious side-effects in the imported files.
[COMMAND_EXECUTION]: The skill uses spawnSync to execute local Node.js scripts (specifically the generator script) as part of the new-game forwarding mechanism. The paths are resolved locally within the project structure.

new-game-scaffold