The Agent Skills Directory

[DYNAMIC_EXECUTION]: The code examples in SKILL.md for request_spawn (GDScript) and RequestSpawn (C#) accept a scene_path string directly from any connected client. This string is passed to load() or GD.Load<PackedScene>() on the server without validation against an allowlist, enabling clients to specify which project resources the server loads and instantiates.
[COMMAND_EXECUTION]: The skill demonstrates Godot's RPC (Remote Procedure Call) system. Methods like send_chat_message and request_spawn use the any_peer access level, allowing any client to execute logic on the server.
[REMOTE_CODE_EXECUTION]: By providing a mechanism for clients to trigger server-side resource loading via unvalidated paths, the skill introduces a vulnerability where a malicious actor could potentially execute unintended code if they can identify or place resources within the game project's filesystem.

godot-prompter-multiplayer-basics