The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill clones and periodically updates the official Roblox/creator-docs repository from GitHub (https://github.com/Roblox/creator-docs). This is a well-known service and organization, and the download is essential for the skill's primary purpose of providing documentation search.
[COMMAND_EXECUTION]: The robloxdocs.py script uses subprocess.run to invoke system tools like git and ripgrep (rg). The implementation passes arguments as lists and does not use shell=True, which is a secure practice that prevents shell injection. Additionally, search queries are tokenized to permit only alphanumeric characters and specific API delimiters (colons, dots, underscores).
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill creates and maintains a local cache of documentation in standard OS-specific cache directories (e.g., ~/.cache/roblox-docs-explorer). It does not access sensitive user files or credentials.
[INDIRECT_PROMPT_INJECTION]: The skill operates by ingesting content from an external GitHub repository, which constitutes an indirect prompt injection surface.
Ingestion points: Documentation files (.md and .yaml) are pulled from the Roblox/creator-docs repository and read into the agent's context.
Boundary markers: The agent is instructed to cite facts and provide concise answers, though explicit delimiters are not added to the search script's output.
Capability inventory: The subagent executing this skill has access to the search script and the file reading tools.
Sanitization: Input queries are filtered by a regex pattern ([A-Za-z0-9_:.]+) before being used for searching.

roblox-docs