The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements networking components that ingest and process untrusted external data, creating an indirect prompt injection surface.
Ingestion points: Network packets are processed in scripts/safe_packet_decoder.gd via get_var(), and external API responses are ingested in scripts/server_matchmaker_client.gd via HTTPRequest.
Boundary markers: The skill explicitly documents and implements a security boundary in scripts/safe_packet_decoder.gd and SKILL.md by mandating get_var(false) to disable object decoding, which prevents a known RCE vector in the Godot engine.
Capability inventory: The skill includes capabilities to disconnect peers (multiplayer.disconnect_peer), execute remote procedures (@rpc), and perform network requests to matchmakers.
Sanitization: The skill employs JSON parsing for API responses and enforces authority validation using get_remote_sender_id() in scripts/server_authority_validator.gd to gate privileged operations.
[SAFE]: The skill explicitly promotes and provides implementations for networking best practices, specifically the prevention of Remote Code Execution (RCE) by forbidding object serialization on untrusted packets.
[SAFE]: External network operations in scripts/server_matchmaker_client.gd are restricted to a placeholder matchmaking API, which is standard for dedicated server architecture and involves no sensitive data exfiltration.

godot-server-architecture