The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches engine version metadata from d.defold.com and downloads engine releases from the official Defold organization repository on GitHub.
[INDIRECT_PROMPT_INJECTION]: The script reads and processes external dependency URLs defined within the local game.project file.
Ingestion points: Reads dependency URLs and library include directories from game.project in the project root.
Boundary markers: Absent; the script assumes URLs in the project configuration are valid targets for download.
Capability inventory: Performs network requests (urllib.request), directory deletion (shutil.rmtree), and file extraction (zipfile).
Sanitization: Implements strict validation using assert_safe_include_dir (regex-based whitelist) and enforces path boundaries during extraction to mitigate traversal risks.
[COMMAND_EXECUTION]: Instructions provide a direct path to execute a local Python script (fetch_deps.py) to perform the project synchronization.
[SAFE]: The extraction logic includes a security check that resolves output paths and verifies they reside within the designated .deps/ folder, effectively preventing zip-slip attacks.
[SAFE]: Dependency directory names are validated against a restricted character set ([A-Za-z0-9_-]+) and checked for path traversal sequences like .. or slashes before processing.

defold-project-setup