godot
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a provided Python script (
scripts/smell_check.py) and Godot engine CLI commands (e.g.,--write-movie) for verification purposes. These operations are standard for development workflows and the script itself performs safe static analysis of source files. - [INDIRECT_PROMPT_INJECTION]: The
smell_check.pyscript reads external GDScript and TSCN files. While this constitutes an ingestion of untrusted data, the script uses static regular expression matching to identify anti-patterns and does not execute the file contents or interpolate them into agent prompts in an unsafe manner. - [SAFE]: The external documentation link provided (Godot 4 official docs) is a trusted resource. The logic within the linting script follows best practices for file handling and avoids dangerous operations like arbitrary shell execution or network requests.
Audit Metadata