godot-prompter-export-pipeline
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches the Butler CLI tool directly from the official itch.io distribution server (
broth.itch.ovh) to facilitate automated deployments. - [COMMAND_EXECUTION]: Uses
OS.executewithin an editor script (inject_version.gd) to run thegitcommand for automated versioning based on repository tags. - [COMMAND_EXECUTION]: Provides configuration examples for Godot's
ssh_remote_deployfeature, which executes shell scripts on a remote host to test builds in a target environment. - [INDIRECT_PROMPT_INJECTION]: The skill establishes an ingestion point for external data by reading the output of system commands during the build process.
- Ingestion points: The
inject_version.gdscript (and equivalent C# code) captures data fromgit describeto populate project settings. - Boundary markers: No specific delimiters are used for the
gitoutput, as it is assumed to be controlled by the project developer. - Capability inventory: The skill utilizes
OS.executefor versioning and shell script execution for remote deployment and CI/CD steps. - Sanitization: The
inject_version.gdscript appliesstrip_edges()to the external input before using it to set theapplication/config/versionsetting.
Audit Metadata