godot-vfx

Pass

Audited by Gen Agent Trust Hub on Oct 31, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external project files (project.godot) and scene files (.tscn) to perform audits, fitting, and building operations.
  • Ingestion points: gd_vfx.py reads project settings; vfx_audit.gd and vfx_capture.gd load and instantiate Godot scenes from the project directory.
  • Boundary markers: There are no explicit delimiters or instructions to the agent to ignore embedded commands within these external files.
  • Capability inventory: The skill leverages gd_run.run_script to execute GDScript logic (e.g., vfx_audit.gd, vfx_jobs.gd) and AgentBuild.save_scene to save generated or modified scenes to the filesystem.
  • Sanitization: No sanitization or validation of the content within ingested project or scene files is performed before processing or execution.
  • [COMMAND_EXECUTION]: The Python helper gd_vfx.py executes Godot-specific commands and scripts via the gd_run utility. These executions are used to perform automated building, static auditing, and windowed captures for VFX evaluation.
  • [DYNAMIC_EXECUTION]: The skill uses gd_run.run_script to execute GDScript logic at runtime for tasks such as calculating particle caps, fitting visibility AABBs, and generating scene twins for the Compatibility renderer. This execution context is localized to the Godot environment and utilizes the skill's own distributed scripts.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 31, 2026, 01:44 AM