godot-prompter-export-pipeline

Pass

Audited by Gen Agent Trust Hub on Oct 12, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches the Butler CLI tool directly from the official itch.io distribution server (broth.itch.ovh) to facilitate automated deployments.
  • [COMMAND_EXECUTION]: Uses OS.execute within an editor script (inject_version.gd) to run the git command for automated versioning based on repository tags.
  • [COMMAND_EXECUTION]: Provides configuration examples for Godot's ssh_remote_deploy feature, which executes shell scripts on a remote host to test builds in a target environment.
  • [INDIRECT_PROMPT_INJECTION]: The skill establishes an ingestion point for external data by reading the output of system commands during the build process.
  • Ingestion points: The inject_version.gd script (and equivalent C# code) captures data from git describe to populate project settings.
  • Boundary markers: No specific delimiters are used for the git output, as it is assumed to be controlled by the project developer.
  • Capability inventory: The skill utilizes OS.execute for versioning and shell script execution for remote deployment and CI/CD steps.
  • Sanitization: The inject_version.gd script applies strip_edges() to the external input before using it to set the application/config/version setting.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 12, 2026, 08:01 PM