The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes several Python scripts (export_build.py, run_tests.py, validate_project.py) designed to automate Godot engine operations such as building, testing, and project validation. These scripts utilize the subprocess.run function with arguments provided as a list, which effectively prevents shell injection attacks.
[EXTERNAL_DOWNLOADS]: The instructions involve downloading the gdUnit4 framework from its official GitHub repository and the playgodot library from the author's GitHub account. These downloads are standard for Godot development and originate from identified, non-malicious sources.
[REMOTE_CODE_EXECUTION]: The deployment guide describes installing the butler tool via curl | sh. Although this method of execution is generally discouraged, the source https://itch.io/butler is the official distribution channel for a well-known service in the gaming community, qualifying it as a safe reference under the trust rules.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface due to the processing of Godot project files and reports.
Ingestion points: The agent parses Godot project metadata (project.godot), script files (*.gd), and test reports in XML format.
Boundary markers: No specific delimiters or safety instructions were found to isolate data from instructions during the processing of these files.
Capability inventory: The skill can execute local Godot commands and perform network-based deployments to Vercel, Netlify, or itch.io.
Sanitization: While shell execution parameters are safely structured, there is no content-level validation or sanitization of the logic contained within the Godot scripts or project files.

godot