godot-resources
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill describes patterns for loading external resource files, which constitutes a data ingestion surface for potentially untrusted inputs.
- Ingestion points:
ResourceLoader.load()is described inSKILL.mdandreferences/resource-patterns.mdfor loading configuration and level data. - Boundary markers: The skill mentions checking for file existence using
ResourceLoader.exists()but does not provide guidance on validating the resource's integrity or origin. - Capability inventory: The skill includes patterns for file writing (
ResourceSaver.save) and object instantiation from files (ResourceLoader.load). - Sanitization: No explicit sanitization or schema validation for the resource data is provided.
- [DYNAMIC_EXECUTION]: The skill uses
ResourceLoader.load()to dynamically load and instantiate resources, which in the Godot engine can include script logic and complex object hierarchies. - Evidence:
SKILL.md(Pattern 4) andreferences/resource-patterns.md(Common API section) detail the dynamic loading of.tresand.resfiles at runtime, which is a form of dynamic asset instantiation.
Audit Metadata