The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides the agent with shell command templates (e.g., printf '%s' "$P" | sha256sum | cut -c1-16) to generate unique keys for project state management. This represents an instruction to execute shell logic on data derived from the local file system.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill ingests untrusted or external data including canonical project paths, the project's project.godot file, and the output generated by external godot-prompter:* domain skills.
Boundary markers: There are no instructions provided to the agent for using delimiters or safety markers when processing data from project files or other skill outputs.
Capability inventory: The skill requires the ability to execute shell commands for hashing and perform file system writes to ~/.godot-prompter/state/.
Sanitization: The instructions lack specific guidance on sanitizing or escaping the project path variable ($P) before its interpolation into shell command strings, which could lead to command injection if a project is maliciously named.

godot-mentor