save-load

No clear evidence of intentional malware (no networking, credentials, or obvious backdoor). However, the loader uses untrusted save-file content to dynamically load and instantiate Godot scenes via a scene_path field with no allowlist/validation and no save-file integrity verification. If save files can be tampered with, this is a high-impact behavioral risk (untrusted resource loading into the scene tree). Additionally, slot_name is used in file paths without sanitization and JSON fields are accessed without schema/type checks, increasing crash/DoS and unexpected file-handling risk.