The Agent Skills Directory

[COMMAND_EXECUTION]: Multiple scripts within the toolkit utilize the subprocess module to execute external commands.
scripts/sprite_generate.py invokes codex exec with the high-risk flag --dangerously-bypass-approvals-and-sandbox, which intentionally removes security protections during execution.
scripts/video_extract_frames.py executes the ffmpeg binary for media processing.
scripts/road_to_aew_integration.py runs npm run generate:sprites to rebuild project manifests.
[DYNAMIC_EXECUTION]: The script scripts/with_server.py uses subprocess.run with shell=True to execute a command provided via CLI arguments. This pattern is susceptible to shell injection if an attacker can manipulate the command string passed to the script.
[EXTERNAL_DOWNLOADS]: The toolkit frequently interacts with several third-party APIs and well-known services to fetch or generate assets.
Fetches configuration and assets from api.meshy.ai, api.worldlabs.ai, and queue.fal.run for AI-driven 3D and 2D asset generation.
Downloads references and models from api.sketchfab.com, api.polyhaven.com, and api.poly.pizza.
These interactions are documented neutrally and follow standard practices, such as using environment variables for authentication tokens.
[INDIRECT_PROMPT_INJECTION]: The skill implements a slot-based prompt scaffolding system (scripts/sprite_prompt.py) that incorporates user-supplied descriptions into prompts for image generation backends. While structured, this represents a surface where malicious input could influence the behavior of the downstream image generation models.

game-dev