The Agent Skills Directory

[PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it ingests data from external sources during the automated inspection of game states.
Ingestion points: The scripts/inspect-threejs-canvas.mjs script captures console error logs, page errors, and custom renderer diagnostics from the target URL's browser environment.
Boundary markers: The collected data is returned to the agent within a structured JSON report, though the instructions do not include specific delimiters to prevent the agent from interpreting instructions found within the logs.
Capability inventory: The skill can execute shell commands like npm test (via SKILL.md) and perform file system operations and network navigation (via scripts/inspect-threejs-canvas.mjs).
Sanitization: The script performs JSON stringification on the captured data but does not filter or sanitize the content of the error strings or diagnostics for potential natural language instructions.
[COMMAND_EXECUTION]: The skill is designed to execute local development commands and automation scripts. It instructs the agent to run npm test and utilizes a Node.js script (inspect-threejs-canvas.mjs) to control a headless browser via Playwright. These actions are legitimate for the purpose of verifying game playability and polish within a developer's local environment.

threejs-game-proof