gdscript-cleanup
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes the
godotbinary with static arguments (--path . --headless --import --quit) to refresh project metadata. This command does not interpolate user input, mitigating command injection risks. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process user-provided GDScript (
.gd) and Scene (.tscn) files, which constitutes an attack surface for indirect prompt injection. - Ingestion points: The agent reads the content of
.gdand.tscnfiles within the target repository. - Boundary markers: The instructions do not specify explicit delimiters or markers to isolate code content from instructions.
- Capability inventory: The skill has the ability to execute the
godotbinary and modify files on the filesystem. - Sanitization: There are no explicit instructions to sanitize or validate the content of the scripts before processing.
Audit Metadata