The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructs the agent to process data from an external tool and write the content directly to the local filesystem, creating an attack surface for indirect prompt injection.
Ingestion points: The text_files and asset_downloads fields returned by the export_godot_character_package tool.
Boundary markers: No boundary markers or 'ignore embedded instructions' warnings are specified for the incoming data in the provided instructions.
Capability inventory: The skill utilizes file system write capabilities to create or update Godot resources (.tres), scenes (.tscn), and potentially script files.
Sanitization: The instructions do not specify any sanitization, validation, or filtering of the content provided by the tool before it is written to the user's project directory.
[EXTERNAL_DOWNLOADS]: The skill performs asset downloads from signed URLs provided by the vendor's official MCP tool.
Details: These downloads are part of the intended workflow for fetching animation assets from the SpriteCook platform. As these originate from the vendor's own infrastructure, they are considered safe within the context of the skill's purpose.

spritecook-use-assets-in-godot