save-load
Warn
Audited by Gen Agent Trust Hub on Apr 14, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill implements a pattern where file paths stored in JSON save files are passed directly to the Godot
load()function. In Godot 4, loading resource files (.tres or .res) can trigger the execution of embedded GDScript. Since save files are often shared or can be modified by users, this allows for arbitrary code execution if a malicious path is inserted into the JSON data. This occurs in the_deserialize_worldfunction in GDScript and theDeserializeWorldmethod in C#. - [COMMAND_EXECUTION]: The dynamic loading of scenes from paths stored in external data constitutes unsafe dynamic execution of code or resources.
Audit Metadata