godot-rendering-lighting

Pass

Audited by Gen Agent Trust Hub on Oct 31, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill facilitates the runtime installation and execution of GDScript files within a Godot project. The Python helper scripts/gd_lighting.py uses shutil.copy2 to deploy scripts into the user's project directory, and gd_run.run_script is used to execute these scripts. Additionally, scripts/agentkit/rendering/sweep.gd employs target.set_indexed and callv to dynamically modify properties and invoke methods on scene objects during visual sweeps.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests external project and scene data which presents a surface for indirect prompt injection if the processed files are malicious.\n
  • Ingestion points: scripts/agentkit/rendering/light_audit.gd and scripts/agentkit/rendering/lookdev.gd read project.godot and .tscn scene files to perform audits and setup calibration environments.\n
  • Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present in the scripts that process external scene data.\n
  • Capability inventory: The skill can modify scenes, save lightmap data (EXR), and execute script logic via the Godot engine.\n
  • Sanitization: File processing is guarded by basic existence checks, but content validation is limited to structural Godot API requirements.\n- [COMMAND_EXECUTION]: The skill relies on spawning the Godot engine as a subprocess to perform rendering, baking, and auditing tasks. These operations are managed via the gd_run module called from scripts/gd_lighting.py.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 31, 2026, 01:44 AM