godot-vfx
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external project files (
project.godot) and scene files (.tscn) to perform audits, fitting, and building operations. - Ingestion points:
gd_vfx.pyreads project settings;vfx_audit.gdandvfx_capture.gdload and instantiate Godot scenes from the project directory. - Boundary markers: There are no explicit delimiters or instructions to the agent to ignore embedded commands within these external files.
- Capability inventory: The skill leverages
gd_run.run_scriptto execute GDScript logic (e.g.,vfx_audit.gd,vfx_jobs.gd) andAgentBuild.save_sceneto save generated or modified scenes to the filesystem. - Sanitization: No sanitization or validation of the content within ingested project or scene files is performed before processing or execution.
- [COMMAND_EXECUTION]: The Python helper
gd_vfx.pyexecutes Godot-specific commands and scripts via thegd_runutility. These executions are used to perform automated building, static auditing, and windowed captures for VFX evaluation. - [DYNAMIC_EXECUTION]: The skill uses
gd_run.run_scriptto execute GDScript logic at runtime for tasks such as calculating particle caps, fitting visibility AABBs, and generating scene twins for the Compatibility renderer. This execution context is localized to the Godot environment and utilizes the skill's own distributed scripts.
Audit Metadata