godot-skills
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONPERSISTENCEPRIVILEGE_ESCALATIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The
start-mcp.jsscript located insub-skills/godot-mcp-auto-launcher/scripts/utilizeschild_process.spawn,execSync, andexecto manage local processes. It runsnpmfor building and starting the server, and uses system utilities such aslsof,ps, andtasklistto monitor port usage and process status. - [PERSISTENCE]: The
chinese-dev-guidesub-skill provides instructions to append environment variable exports (LANG,LC_ALL,LANGUAGE) to the user's shell profile (~/.bashrc). While intended for locale configuration, this constitutes a modification of shell initialization files to maintain settings across sessions. - [PRIVILEGE_ESCALATION]: The
chinese-dev-guidesub-skill includes commands that requiresudoprivileges, specificallysudo locale-genandsudo update-locale, to perform system-wide locale generation and configuration. - [EXTERNAL_DOWNLOADS]: The
start-mcp.jsscript triggersnpm run buildandnpm run startwithin the server directory (/mnt/d/godot-mcp/server), which implies the resolution and potential download of dependencies from the NPM registry during the build process.
Audit Metadata