godot-multiplayer
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The Python harness (
scripts/gd_net.py) usessubprocess.Popenandsubprocess.runto manage multi-client simulations. It creates temporary project clones usingcpandrsyncto allow parallel execution and launches Godot binaries with specific arguments. These operations are essential for the skill's function and the commands are constructed using safe path joining without shell interpolation. - [DYNAMIC_EXECUTION]: The Godot audit script (
scripts/agentkit/multiplayer/net_audit.gd) usesGDScript.new()andreload()to programmatically verify project scripts for syntax errors and networking compatibility. This dynamic compilation is a standard technique for static analysis within the Godot engine environment. - [INDIRECT_PROMPT_INJECTION]: The skill processes Godot project files, scripts, and log outputs. While this creates a theoretical ingestion surface for indirect prompt injection if a malicious project were analyzed, the risk is negligible as the skill is designed for developer-controlled project auditing and uses structured JSON parsing for simulation results.
Audit Metadata