godot-skills

Pass

Audited by Gen Agent Trust Hub on Sep 24, 2026

Risk Level: SAFECOMMAND_EXECUTIONPERSISTENCEPRIVILEGE_ESCALATIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The start-mcp.js script located in sub-skills/godot-mcp-auto-launcher/scripts/ utilizes child_process.spawn, execSync, and exec to manage local processes. It runs npm for building and starting the server, and uses system utilities such as lsof, ps, and tasklist to monitor port usage and process status.
  • [PERSISTENCE]: The chinese-dev-guide sub-skill provides instructions to append environment variable exports (LANG, LC_ALL, LANGUAGE) to the user's shell profile (~/.bashrc). While intended for locale configuration, this constitutes a modification of shell initialization files to maintain settings across sessions.
  • [PRIVILEGE_ESCALATION]: The chinese-dev-guide sub-skill includes commands that require sudo privileges, specifically sudo locale-gen and sudo update-locale, to perform system-wide locale generation and configuration.
  • [EXTERNAL_DOWNLOADS]: The start-mcp.js script triggers npm run build and npm run start within the server directory (/mnt/d/godot-mcp/server), which implies the resolution and potential download of dependencies from the NPM registry during the build process.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 24, 2026, 09:41 AM