dialogue-manager
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides a link to the official GitHub repository for the 'godot_dialogue_manager' addon (github.com/nathanhoad/godot_dialogue_manager). This is a standard reference for plugin installation.
- [DYNAMIC_EXECUTION]: The documentation describes the
create_resource_from_text(text)method. This function allows for the compilation of dialogue logic from a string at runtime, which is a core feature of the tool for procedural dialogue generation but involves dynamic interpretation of script-like content. - [INDIRECT_PROMPT_INJECTION]: The skill documents an attack surface where data processed by the Dialogue Manager (specifically
.dialoguefiles) can trigger logic execution via 'mutations' and 'conditions'. - Ingestion points: External
.dialogueresource files and raw strings passed to thecreate_resource_from_textfunction inSKILL.md(Section 4). - Boundary markers: The provided documentation does not specify the use of delimiters or warnings to prevent the engine from obeying instructions embedded within the dialogue text.
- Capability inventory: The dialogue system can call methods on global objects (
do SomeGlobal.method()) and modify global state variables (set SomeGlobal.property = true), which grants the dialogue content direct influence over game logic. - Sanitization: There is no mention of sanitization or validation logic for the input dialogue data within the skill's instructions.
Audit Metadata