The Agent Skills Directory

[CREDENTIALS_UNSAFE]: Hardcoded secrets and encryption keys are present in the project scripts. Specifically, scripts/meta_progression_manager.gd defines a SECRET_KEY constant and scripts/meta_stats_resource.gd defines a CRYPTO_KEY used with the save_encrypted_pass function for encrypting local save data.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from local files, creating a potential attack surface.
Ingestion points: Files user://run_state.json, user://meta_progression.save, and user://meta_progression.cfg are loaded by scripts/json_state_serializer.gd, scripts/meta_progression_manager.gd, and scripts/meta_stats_resource.gd respectively.
Boundary markers: None identified. The scripts load and parse the content directly without using delimiters or instructions to ignore embedded commands.
Capability inventory: The skill uses dynamic execution capabilities through call(), set(), and has_method() on Game Objects, as seen in scripts/move_command_object.gd and scripts/roguelike_patterns.gd. It also performs file system write operations.
Sanitization: There is no evidence of sanitization, validation, or schema enforcement for the loaded JSON or configuration data before it is integrated into the application state.
[DYNAMIC_EXECUTION]: The implementation relies on dynamic method and property resolution. Scripts like scripts/move_command_object.gd and scripts/json_state_serializer.gd use call() and set() to interact with entity states based on runtime data, which can lead to unexpected behavior if the source data is manipulated.

godot-genre-roguelike