The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The web_resource_lazy_loader.gd script implements a pattern using ProjectSettings.load_resource_pack() to download and load PCK files from arbitrary URLs. Since PCK files can contain compiled GDScript and scene data, loading them from untrusted remote sources allows for arbitrary code execution within the Godot engine process.
[COMMAND_EXECUTION]: Multiple scripts demonstrate unsafe use of JavaScriptBridge.eval() where GDScript variables are interpolated directly into JavaScript string literals without sanitization or escaping. This creates significant injection vulnerabilities:
In web_clipboard_interface.gd, the copy_text function interpolates the text variable into navigator.clipboard.writeText('%s'). An attacker-controlled string containing a single quote followed by JS commands (e.g., '); alert(1); //) could execute arbitrary JavaScript in the user's browser.
In web_external_url_opener.gd, the url and target variables are interpolated into window.open('%s', '%s', ...), allowing for URL-based injection attacks.
In web_bridge_sync.gd, the key and data (via base64) are interpolated into localStorage.setItem('%s', '%s'). While the base64 data is safe, a malicious key could break out of the JS string.
[DYNAMIC_EXECUTION]: The skill frequently uses JavaScriptBridge.eval() to generate and execute JavaScript code at runtime. This is considered a fragile and insecure practice compared to using JavaScriptBridge.get_interface() or JavaScriptBridge.create_callback(), as it bypasses standard object-based interactions in favor of raw string evaluation.
[INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface for indirect prompt injection by facilitating the ingestion of untrusted data from the browser environment into the agent's context.
Ingestion points: Data is ingested via web_clipboard_interface.gd (clipboard paste) and web_local_storage_wrapper.gd (localStorage read).
Boundary markers: No boundary markers or 'ignore' instructions are present to delimit untrusted data.
Capability inventory: The skill possesses high-privilege capabilities including JavaScriptBridge.eval() for browser command execution and ProjectSettings.load_resource_pack() for engine-level code execution.
Sanitization: Sanitization is absent in several key scripts where external data is interpolated into execution sinks.

godot-platform-web