godot-ui
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to interact with the local Godot engine binary using commands such as
godot --versionandgodot --headless --path <project> --editor --quit. These are standard developer operations used to verify engine compatibility and project integrity. - [INDIRECT_PROMPT_INJECTION]: The skill functions by analyzing external project files including
project.godot, scene files (.tscn), and scripts (.gd). - Ingestion points: The agent reads project settings and UI scene configurations from the local filesystem to provide troubleshooting and design advice.
- Boundary markers: No specific delimiters are mandated for the analyzed content, but instructions focus on extracting structured UI properties.
- Capability inventory: Capabilities are limited to filesystem read access and local command-line execution of the Godot binary for validation purposes.
- Sanitization: The skill does not explicitly sanitize file contents, but its logic is focused on interpreting standard Godot UI nodes and theme properties, posing no elevated risk of code execution from data.
- [SAFE]: No malicious patterns were identified. The skill does not contain hardcoded credentials, remote code downloads, obfuscation, persistence mechanisms, or unauthorized network exfiltration. The instructions are aligned with industry-standard Godot development practices.
Audit Metadata