godot-nodes-scenes
Pass
Audited by Gen Agent Trust Hub on Nov 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions direct the agent to run a bundled Python script (
scripts/check_godot_project.py) to perform static analysis on a user-provided Godot project directory. The script is a self-contained utility that uses only Python standard libraries and performs read-only operations to detect broken file references and configuration errors. - [INDIRECT_PROMPT_INJECTION]: The diagnostic script processes content from external, potentially untrusted sources (Godot project files like
.tscn,.tres, and.gd). - Ingestion points: The script
scripts/check_godot_project.pyreads file contents, metadata headers, and directory structures from the project path provided by the user. - Boundary markers: The script output (standard text or JSON) does not use specific delimiters or include warnings to the agent to ignore instructions embedded within the processed file content (e.g., within error messages or file paths).
- Capability inventory: The agent is instructed to execute the script via shell command and act on its output to fix project errors.
- Sanitization: The script parses and extracts data but does not sanitize it against prompt injection techniques before presenting it to the agent.
Audit Metadata