godot

Pass

Audited by Gen Agent Trust Hub on Sep 22, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute a provided Python script (scripts/smell_check.py) and Godot engine CLI commands (e.g., --write-movie) for verification purposes. These operations are standard for development workflows and the script itself performs safe static analysis of source files.
  • [INDIRECT_PROMPT_INJECTION]: The smell_check.py script reads external GDScript and TSCN files. While this constitutes an ingestion of untrusted data, the script uses static regular expression matching to identify anti-patterns and does not execute the file contents or interpolate them into agent prompts in an unsafe manner.
  • [SAFE]: The external documentation link provided (Godot 4 official docs) is a trusted resource. The logic within the linting script follows best practices for file handling and avoids dangerous operations like arbitrary shell execution or network requests.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 22, 2026, 03:08 PM