The Agent Skills Directory

[EXTERNAL_DOWNLOADS] (MEDIUM): The skill instructs the agent to use sozo init, which downloads a starter template from https://github.com/dojoengine/dojo-starter. The dojoengine organization is not included in the Trusted External Sources list, making this an unverifiable dependency.
[COMMAND_EXECUTION] (LOW): The skill requires the Bash tool to execute various Dojo CLI commands (sozo, katana). This is a legitimate requirement for the skill's purpose but provides a capability surface for the agent.
[CREDENTIALS_UNSAFE] (LOW): The provided configuration template for dojo_dev.toml contains a truncated placeholder private key (0xc5b2f...). While clearly intended as a non-functional example for local development, it encourages the practice of placing sensitive credentials in configuration files.
[PROMPT_INJECTION] (LOW): The skill exhibits an Indirect Prompt Injection surface (Category 8).
Ingestion points: The skill accepts a user-provided project name (e.g., "Initialize a Dojo game called [name]").
Boundary markers: No specific boundary markers or "ignore embedded instruction" warnings are provided in the command templates.
Capability inventory: The skill uses Bash for command execution and Write for file creation.
Sanitization: The skill does not explicitly define sanitization for the project name variable before it is passed to the Bash tool, which could lead to command injection if an adversarial user provides a malicious name string.

dojo-init