The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes multiple Python scripts (e.g., run_project.py, export_project.py, validate_project.py, run_scenario.py) that execute shell commands using the subprocess module to automate Godot engine tasks such as project runs, exports, and validations. These scripts utilize the list-form of arguments, which prevents common shell injection vulnerabilities. The executable path and project directories are provided as arguments, which is standard for local developer tools.
[INDIRECT_PROMPT_INJECTION]: The skill performs extensive static analysis (linting) and runtime validation of Godot project files (.gd, .tscn, .tres). This creates an attack surface where a malicious Godot project could potentially contain embedded instructions (in comments, strings, or metadata) designed to influence the AI agent's reasoning or actions during the analysis and repair loop. The risk is minimized by the technical nature of the tools, which primarily output structured diagnostics.
[EXTERNAL_DOWNLOADS]: The documentation (references/ci.md) includes standard instructions for setting up CI/CD pipelines, which involve downloading the Godot engine and export templates via curl from the official godotengine GitHub organization. These references are to well-known, trusted sources and do not contribute to risk escalation.

godot