The Agent Skills Directory

[DYNAMIC_EXECUTION]: The DialogueExpressionParser script utilizes Godot's built-in Expression class to parse and execute logic strings at runtime. While this is a standard technique for evaluating narrative conditions in game engines, it represents dynamic execution of logic based on string variables.
Evidence: In scripts/dialogue_expression_parser.gd, the can_show_choice function uses Expression.new(), expression.parse(condition, ...) and expression.execute(...) to evaluate game state logic from text.
[INDIRECT_PROMPT_INJECTION]: The skill implements a pattern in romance_patterns.gd that enables hyperlinked choices within UI text by connecting metadata clicks directly to the operating system's default shell handler. This creates a vulnerability surface where malicious links or local file paths can be injected into narrative data.
Ingestion points: Narrative and dialogue data rendered via RichTextLabel components in the game UI.
Capability inventory: OS.shell_open() (capable of opening external URLs, local file paths, and system handlers).
Boundary markers: None; the implementation lacks delimiters or warnings to treat embedded instructions in narrative data as untrusted.
Sanitization: Absent; the logic passes the meta content directly to the shell handler without verifying the URL scheme or validating the destination.
Evidence: scripts/romance_patterns.gd defines setup_meta_links, which connects the meta_clicked signal of a RichTextLabel to a lambda function executing OS.shell_open(str(meta)).

godot-genre-romance