The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The export_pck_patch_loader.gd script provides a mechanism to load external resource packs (PCKs), which can contain executable GDScript, presenting an attack surface for indirect code injection if the source is compromised.
Ingestion points: The script defines a PATCH_URL constant for downloading external updates and a LOCAL_PATH for storage.
Boundary markers: No explicit boundary markers or integrity verification (e.g., checksums) are implemented for the loaded PCK content.
Capability inventory: The skill utilizes ProjectSettings.load_resource_pack() and OS.execute() across several scripts, allowing for resource mounting and system-level command execution.
Sanitization: The skill lacks sanitization or validation of external resources before they are mounted into the application context.
[DYNAMIC_EXECUTION]: The skill implements patterns for loading and executing code at runtime via external archives.
Evidence: scripts/export_pck_patch_loader.gd uses ProjectSettings.load_resource_pack() to mount external PCK files, which can include scripts that are executed by the engine.
[EXTERNAL_DOWNLOADS]: The skill configuration involves downloading binaries and utilizing third-party tools during the build process.
Evidence: scripts/export_ci_github_actions.yml fetches Godot editor binaries and export templates from the official godotengine/godot-builds GitHub repository.
Evidence: The same CI workflow utilizes the third-party firebelley/godot-export GitHub Action.
[COMMAND_EXECUTION]: The skill automates workflows using local system commands via Godot's built-in APIs and shell scripts.
Evidence: scripts/export_version_sync.gd and scripts/export_universal_manager.gd use OS.execute() to run git and the Godot editor binary.
Evidence: scripts/headless_build.sh performs local file manipulations using sed and mkdir to prepare build artifacts.

godot-export-builds