godot-master

Pass

Audited by Gen Agent Trust Hub on Oct 12, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill presents an ingestion surface for indirect prompt injection as it is designed to analyze and orchestrate external Godot project files (scripts, scenes, configs) and perform automated builds or audits.
  • Ingestion points: Project files within the user's res:// directory are processed by the agent during audits or build sequences (specified in SKILL.md and references/analyst.md).
  • Boundary markers: The skill explicitly instructs the agent to use boundary markers (<<<CONTEXT_START>>> and <<<CONTEXT_END>>>) to wrap analysis and isolate untrusted data (specified in references/mcp-scene-builder.md).
  • Capability inventory: The skill uses subprocess calls (OS.execute for CLI builds), file system operations (ResourceSaver for saving scenes), and the Model Context Protocol (MCP) for programmatic node manipulation (specified in references/builder.md and references/mcp-scene-builder.md).
  • Sanitization: The skill provides explicit guidance on sanitizing node names (alphanumeric/underscored) and verifying paths (must start with res://) to prevent injection (specified in references/mcp-scene-builder.md).
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions for setting up the Model Context Protocol (MCP) server for Godot.
  • Evidence: Instructions in references/mcp-setup.md guide the user or agent to install @modelcontextprotocol/server-godot via npm. This targets a well-known service for AI tool orchestration.
  • [COMMAND_EXECUTION]: The skill documents and orchestrates command-line automation for Godot project builds and CI/CD pipelines.
  • Evidence: references/builder.md and references/export-builds.md provide patterns for executing Godot headlessly via CLI flags for exporting binaries and running tests. These are standard operations for the skill's primary purpose of build orchestration.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 12, 2026, 08:02 PM