The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes project files and directories as part of its auditing function, which introduces an indirect prompt injection surface.
Ingestion points: Reads files and directory structures via os.walk and file reading in audit_signals.py, audit_type_hints.py, and runtime metrics in .gd scripts.
Boundary markers: None explicitly defined in the provided audit logic.
Capability inventory: File reading, console reporting, and engine performance monitoring. No network exfiltration or file writing capabilities were identified in the audit scripts.
Sanitization: None observed in the regex-based static analysis scripts.
[SAFE]: The skill references external documentation and related skills located on GitHub. All identified links point to the vendor's official organization (thedivergentai), which is consistent with the skill's authorship.
[SAFE]: The skill actively promotes security best practices for Godot development, specifically warning against dangerous patterns like Expression.execute() and get_var(true) on untrusted data, which mitigate potential Remote Code Execution (RCE) risks in end-user projects.

godot-auditor