The Agent Skills Directory

[DYNAMIC_EXECUTION]: The ui_scale_manager.gd script implements a set_theme function that dynamically loads resources using the load() function with a variable path. In the Godot engine, resource loading is a form of dynamic execution because resources (.tres, .res) can have scripts attached that execute when the resource is loaded or instantiated. The use of a computed path for loading is a potential vector for executing unintended logic if the path is not strictly validated.
Evidence: scripts/ui_scale_manager.gd: var new_theme := load(theme_path) as Theme
[INDIRECT_PROMPT_INJECTION]: The set_theme capability creates a surface for indirect prompt injection by accepting a string path as a parameter. If an agent invokes this function based on data from untrusted external sources, it could be manipulated into loading a malicious resource from the application's filesystem.
Ingestion points: theme_path parameter in set_theme (scripts/ui_scale_manager.gd).
Boundary markers: No delimiters or validation logic are present in the function.
Capability inventory: load() (resource instantiation) and get_tree().root.theme (global application of the resource).
Sanitization: The script lacks path validation or integrity checks for the theme_path argument before the load operation is performed.

godot-ui-theming