bevy-porting

Pass

Audited by Gen Agent Trust Hub on May 17, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/flash/swf_assets.py utilizes subprocess.run to execute an external tool named ffdec. This is a documented and intended functionality used to extract assets from Flash SWF files during the porting process. The command is constructed using a list of arguments and does not invoke a shell, which prevents command injection vulnerabilities.
  • [SAFE]: The utility scripts (e.g., asset_audit.py, gms2_inventory.py, tscn_inventory.py) perform local file system operations to read and inventory game project files. These scripts use standard Python libraries for regular expressions, JSON parsing, and XML processing, and they operate entirely within the local scope provided by the user.
Audit Metadata
Risk Level
SAFE
Analyzed
May 17, 2026, 01:54 AM
Security Audit — agent-trust-hub — bevy-porting