The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The script scripts/meta_stats_resource.gd uses a hardcoded encryption key CRYPTO_KEY = "expert_godot_roguelike_key" for the save_encrypted_pass function. While providing a functional example for local save protection, hardcoded keys can be easily extracted from the compiled binary. Additionally, scripts/meta_progression_manager.gd contains a placeholder SECRET_KEY = "CHANGE_ME_IN_PROD" intended for developer replacement.
[OBFUSCATION]: The scripts/meta_progression_manager.gd script utilizes Marshalls.utf8_to_base64 and Marshalls.base64_to_utf8 to encode local save files (user://meta_progression.save). The skill explicitly describes this as a method to deter casual save-file editing by players, which is a standard game development pattern rather than an attempt to hide malicious code.
[INDIRECT_PROMPT_INJECTION]: The skill implements systems to process untrusted data from local save files and user-provided seeds, creating an attack surface for indirect injection.
Ingestion points: Data is ingested via load_run_state() in scripts/json_state_serializer.gd and load_progress() in scripts/meta_progression_manager.gd, as well as the seed_val parameter in scripts/run_manager.gd.
Boundary markers: No specific delimiters or validation warnings are used to isolate the data from the logic flow.
Capability inventory: The skill has capabilities to write to the file system (user://) and execute asynchronous tasks via WorkerThreadPool.
Sanitization: The skill relies on JSON.parse() for structural validation, which prevents malformed data but does not sanitize the logical content of the resulting Dictionary objects.

godot-genre-roguelike