The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The script scripts/web_resource_lazy_loader.gd implements the capability to download and execute Godot resource packs (PCKs) from remote URLs.\n
Evidence: The load_remote_pck(url) function uses HTTPRequest to fetch a binary payload and subsequently calls ProjectSettings.load_resource_pack(body). Since PCK files can contain compiled GDScript, this allows for arbitrary code execution within the engine environment if the source URL is not strictly validated or comes from an untrusted source.\n- [COMMAND_EXECUTION]: Multiple scripts utilize JavaScriptBridge.eval() with direct string interpolation of function arguments, creating several points for JavaScript injection within the browser environment.\n
Evidence in scripts/web_clipboard_interface.gd: The copy_text(text) function interpolates the text parameter directly into the JS string: navigator.clipboard.writeText('%s'). An attacker-controlled string can break the literal context to execute arbitrary JavaScript.\n
Evidence in scripts/web_bridge_sync.gd: The functions save_to_local_storage(key, ...), load_from_local_storage(key), set_tab_title(title), and send_analytics_event(event_name, ...) all use raw string interpolation for their respective eval calls, allowing for injection via the key, title, or event_name parameters.\n
Evidence in scripts/web_external_url_opener.gd: The open_url(url, ...) function interpolates the url argument into window.open('%s', ...), posing a similar risk if the input is not sanitized.\n- [INDIRECT_PROMPT_INJECTION]: The skill architecture creates significant attack surfaces by ingesting untrusted data and routing it to powerful engine or browser capabilities.\n
Ingestion points: Data enters the system through remote URLs (web_resource_lazy_loader.gd), JavaScript messages via the sendToGodot bridge (web_json_rpc_bridge.gd), and the browser clipboard (web_clipboard_interface.gd).\n
Capability inventory: The skill has access to JavaScript execution (JavaScriptBridge.eval), browser storage, and dynamic resource loading (ProjectSettings.load_resource_pack).\n
Sanitization: There is inconsistent use of sanitization; while web_json_rpc_bridge.gd uses json_escape(), several other scripts (e.g., web_bridge_sync.gd) use raw string interpolation for sensitive bridge operations.\n
Boundary markers: No explicit markers or warnings are used to ensure the agent ignores malicious instructions embedded within the ingested data.

godot-platform-web