godot-rendering-lighting
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill facilitates the runtime installation and execution of GDScript files within a Godot project. The Python helper
scripts/gd_lighting.pyusesshutil.copy2to deploy scripts into the user's project directory, andgd_run.run_scriptis used to execute these scripts. Additionally,scripts/agentkit/rendering/sweep.gdemploystarget.set_indexedandcallvto dynamically modify properties and invoke methods on scene objects during visual sweeps.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests external project and scene data which presents a surface for indirect prompt injection if the processed files are malicious.\n - Ingestion points:
scripts/agentkit/rendering/light_audit.gdandscripts/agentkit/rendering/lookdev.gdreadproject.godotand.tscnscene files to perform audits and setup calibration environments.\n - Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present in the scripts that process external scene data.\n
- Capability inventory: The skill can modify scenes, save lightmap data (EXR), and execute script logic via the Godot engine.\n
- Sanitization: File processing is guarded by basic existence checks, but content validation is limited to structural Godot API requirements.\n- [COMMAND_EXECUTION]: The skill relies on spawning the Godot engine as a subprocess to perform rendering, baking, and auditing tasks. These operations are managed via the
gd_runmodule called fromscripts/gd_lighting.py.
Audit Metadata