godot-nodes-scenes
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from Godot project files, which could contain malicious instructions designed to influence the agent.
- Ingestion points: The
scripts/check_godot_project.pyscript reads and parses project files including.tscn,.tres,.gd, andproject.godotfrom a user-specified directory. - Boundary markers: There are no explicit boundary markers or instructions to the agent to disregard natural language content found within the analyzed project files.
- Capability inventory: The skill executes a Python script that reads the local file system. The agent is then instructed to interpret the script's output and perform file modifications ("Fix every ERROR") based on that output.
- Sanitization: While the script parses structured data, it does not include sanitization logic to prevent embedded instructions in file metadata or comments from being interpreted by the agent.
Audit Metadata