The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill implements a pattern where game logic is stored in Script objects within Resource files and instantiated at runtime.
Evidence: In SKILL.md and scripts/card_data.gd, the CardData resource contains an @export var effect_script: Script or script_logic field. The play_card function in SKILL.md executes this via var effect = card.effect_script.new().
Impact: This architectural choice allows for powerful card effects but introduces a risk where malicious GDScript could be executed if the agent or user loads card resources (.tres files) from untrusted external sources.
[INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface by processing card data resources which could be supplied by external or untrusted entities.
Ingestion points: Data-driven card definitions in scripts/card_data.gd and scripts/card_data_resource.gd serve as the primary entry point for untrusted data.
Boundary markers: No delimiters or instructional warnings are used to separate card metadata (name, description) from agent instructions.
Capability inventory: The skill has access to the Godot SceneTree and file system via script execution, and can manipulate UI components and board states.
Sanitization: There is no evidence of validation or sanitization for the content of card resources before they are processed by the game logic or presented to the agent.

godot-genre-card-game