The Agent Skills Directory

[COMMAND_EXECUTION]: The orchestration script (gd_pipeline.py) and CI scripts (godot_ci.sh) execute Godot binaries, uvx (for actionlint), and MCP servers. These executions are performed using list-based arguments in subprocess calls, which prevents shell injection vulnerabilities.- [EXTERNAL_DOWNLOADS]: The skill downloads Godot binaries, export templates, and the gdUnit4 testing framework from official GitHub repositories. These downloads are verified against hardcoded or official SHA-256 and SHA-512 checksums, ensuring the integrity of the external tools and protecting against supply chain attacks.- [INDIRECT_PROMPT_INJECTION]: The skill ingests external assets (GLB files) and manifest data. It implements robust sanitization through strict regex-based normalization and validation rules for IDs and file names (e.g., enforcing the pattern ^[a-z][a-z0-9]*(_[a-z0-9]+)+$). This mitigates risks such as path traversal or the injection of malicious instructions via file metadata.

scenario-godot-pipeline-automation