The Agent Skills Directory

[COMMAND_EXECUTION]: The Python utility scripts/gd_architecture.py utilizes subprocess.run to execute the system cp command for project cloning and the Godot engine binary for smoke testing exported game packages. These operations are scoped to the project environment and are standard for the skill's build and audit functionality.
[INDIRECT_PROMPT_INJECTION]: The skill includes auditing and cataloging tools (arch_audit.gd, build_catalog.gd) that process Godot scenes (.tscn) and resources (.tres) from the user's project directory. This represents a potential attack surface if the tools are run on untrusted project data.
Ingestion points: Scene and resource files detected by recursive directory walks in arch_audit.gd and build_catalog.gd.
Boundary markers: None; the tools process files directly through the Godot engine's resource loading system.
Capability inventory: The audit tool instantiates scenes in the tree (instantiate(), add_child()), and the catalog tool saves generated resources to disk (ResourceSaver.save()).
Sanitization: None; the tools assume a trusted developer project context.
[SAFE]: The skill demonstrates high security awareness by implementing a JSON-based save system (save_service.gd) that explicitly avoids dangerous functions like load(), str_to_var(), or ConfigFile.parse() on player-supplied data, thereby preventing code injection vulnerabilities common in Godot projects.

godot-architecture