The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes external binaries such as ImageMagick, FFmpeg, and Godot using subprocess.run with list-based arguments. It employs strict path normalization and validation to ensure that user-provided asset names or paths cannot result in directory traversal or command injection.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted asset metadata from JSON sidecars and generates summaries for AI agent consumption. This attack surface is mitigated by the skill's core auditing logic, which enforces file signature verification, integrity hashing, and explicit quarantine of active or unsafe content.
[SAFE]: The skill includes logic to detect and isolate potentially sensitive file types including executables, scripts, and archives within untrusted asset dumps, preventing their inclusion in the final library through a mandatory quarantine process.

prepare-godot-assets