The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill includes boilerplate code in android_runtime_permissions.gd and platform_mobile_patterns.gd to request Android runtime permissions such as CAMERA, WRITE_EXTERNAL_STORAGE, and READ_EXTERNAL_STORAGE. These are standard requirements for mobile applications accessing device hardware or local files.
[DYNAMIC_EXECUTION]: In platform_mobile_patterns.gd, the script uses JavaClassWrapper.wrap to interface with the native Android JNI bridge (specifically android.os.Build$VERSION). This is a standard method for Godot applications to query native OS properties but represents a bridge to native code execution.
[INDIRECT_PROMPT_INJECTION]: The skill establishes an attack surface through its data ingestion and processing logic:
Ingestion points: Raw sensor data from the accelerometer and gyroscope in mobile_sensor_fusion.gd, multi-touch index data in mobile_gesture_recognizer.gd, and user-supplied strings for social features in native_share_invoker.gd.
Boundary markers: The scripts do not implement specific boundary markers or delimiters when processing these external data streams.
Capability inventory: Access to native Android APIs via JNI, hardware haptics control, and integration with platform-specific In-App Purchase (IAP) singletons.
Sanitization: Sensor data and user-provided strings are passed to movement logic or native OS share sheets without additional sanitization or validation layers.

godot-platform-mobile