The Agent Skills Directory

[COMMAND_EXECUTION]: The ingest_glbs function in scripts/gd_world.py uses subprocess.run and shutil.copy2 to move files using paths constructed from an external manifest input. The name and category fields from this manifest are not sanitized, which could allow a path traversal attack to overwrite files outside the intended project directory.
[DYNAMIC_EXECUTION]: The compile function in scripts/agentkit/world/world_project.gd creates new GDScript instances and calls reload() at runtime to verify the syntax of script files. While intended for validation, this pattern involves dynamic code loading and execution.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external assets (GLB files) and manifests (JSON) which could be used as vectors for indirect prompt injection to influence agent behavior or exploit file processing logic.
Ingestion points: External GLB files and JSON manifests are processed in scripts/gd_world.py and scripts/agentkit/world/post_import_prop.gd.
Boundary markers: There are no explicit delimiters or instructions to the agent to ignore potentially malicious embedded content in these files.
Capability inventory: The skill has significant capabilities including file system write access, project import execution, and script compilation checks.
Sanitization: Paths and metadata extracted from the manifests are used directly without validation against an allowlist or normalization to prevent directory traversal.

godot-3d-world