godot-debugging-profiling
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the official Godot Engine documentation for migration guides and debugging tutorials. These links point to well-known, trusted domains (docs.godotengine.org) and provide legitimate technical context for the skill's purpose.
- [INDIRECT_PROMPT_INJECTION]: The skill implements a remote debug console pattern in
remote_debug_console.gdand an engine message interceptor inengine_error_interceptor.gdwhich process external data at runtime. - Ingestion points: User-provided strings via the
LineEditUI in the remote console and intercepted C++ engine messages. - Boundary markers: Commands in the remote console are parsed through a strict
matchblock, ensuring only predefined functions are executed. - Capability inventory: The skill's capabilities are restricted to internal engine diagnostics, visual drawing for debugging, and logging. No scripts perform sensitive file access, network exfiltration, or arbitrary shell command execution.
- Sanitization: The input processing in the remote console uses explicit string comparison (match), preventing arbitrary instruction injection into the engine state.
Audit Metadata