godot-multiplayer

Pass

Audited by Gen Agent Trust Hub on Oct 31, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The Python harness (scripts/gd_net.py) uses subprocess.Popen and subprocess.run to manage multi-client simulations. It creates temporary project clones using cp and rsync to allow parallel execution and launches Godot binaries with specific arguments. These operations are essential for the skill's function and the commands are constructed using safe path joining without shell interpolation.
  • [DYNAMIC_EXECUTION]: The Godot audit script (scripts/agentkit/multiplayer/net_audit.gd) uses GDScript.new() and reload() to programmatically verify project scripts for syntax errors and networking compatibility. This dynamic compilation is a standard technique for static analysis within the Godot engine environment.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes Godot project files, scripts, and log outputs. While this creates a theoretical ingestion surface for indirect prompt injection if a malicious project were analyzed, the risk is negligible as the skill is designed for developer-controlled project auditing and uses structured JSON parsing for simulation results.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 31, 2026, 01:44 AM