Godot Multiplayer Engineer
Pass
Audited by Gen Agent Trust Hub on Oct 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides legitimate technical documentation and GDScript examples for game networking. The instructions follow security best practices by emphasizing that the server must remain the sole authority for gameplay state and must validate all client requests.\n- [INDIRECT_PROMPT_INJECTION]: The skill defines systems that ingest data from external network peers via Godot's RPC mechanism. While this creates a potential attack surface for external data, the skill includes specific mitigations and validation logic.\n
- Ingestion points: Network data received via RPC functions such as
send_input(direction)andrequest_pick_up_item(item_id)inSKILL.md.\n - Boundary markers: The instructions explicitly mandate that the server (peer ID 1) must own all gameplay-critical state and validate all mutations.\n
- Capability inventory: The skill uses
ENetMultiplayerPeer,WebRTCMultiplayerPeer,MultiplayerSpawner, andMultiplayerSynchronizerto manage network connections and scene state.\n - Sanitization: The provided code examples demonstrate validating the
remote_sender_idand performing logic checks (e.g., distance verification) before processing client requests.
Audit Metadata