The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The request_spawn RPC in SKILL.md (both GDScript and C# examples) allows any connected peer to send a scene_path string that the server then processes using the load() function. This is a critical vulnerability that allows an attacker to force the server to load and execute any scene or script resource available in the project's filesystem.
[DYNAMIC_EXECUTION]: The implementation in SKILL.md relies on dynamic resource loading based on unvalidated input from remote network peers. By passing client-controlled strings directly to load() and instantiate(), the skill introduces a vector for executing arbitrary logic on the authoritative server.
[INDIRECT_PROMPT_INJECTION]: The skill exposes a network-facing attack surface where untrusted data influences high-privilege server actions.
Ingestion points: The scene_path argument in the request_spawn RPC within SKILL.md.
Boundary markers: Absent; the code does not implement a whitelist or restrict the path to a specific directory.
Capability inventory: The server possesses the capability to load resources, instantiate objects, and modify the global scene tree, all of which are triggered by the unvalidated client input.
Sanitization: Absent; the code only checks if the resulting scene object is null, which does not prevent the loading of unauthorized or malicious resources.

multiplayer-basics