godot
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The helper scripts provided with the skill (
export_build.py,run_tests.py, andvalidate_project.py) utilize thesubprocessmodule to programmatically interact with the Godot engine. These scripts correctly pass arguments as a list tosubprocess.run(), which is the standard secure practice to prevent command injection. - [EXTERNAL_DOWNLOADS]: The documentation and CI/CD examples reference several external resources and tools:
- Fetches the Butler CLI tool from itch.io, which is a well-known game distribution service.
- Downloads specialized automation builds of the Godot editor from the author's own GitHub repository (
Randroids-Dojo/godot). - Installs community-standard Python packages (
playgodot,pytest) and Node.js-based deployment tools (vercel,netlify-cli) from official registries. - [REMOTE_CODE_EXECUTION]: The skill documents setup procedures that involve executing remote code or binaries in a development context, such as installing the Butler CLI via a shelled script (
curl | sh) and running the custom Godot editor binaries required for the PlayGodot framework. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process Godot project files and scripts as part of its development workflow, which presents a surface for indirect instructions.
- Ingestion points: Reads
project.godot,export_presets.cfg, and project GDScript files. - Boundary markers: No specific boundary markers are defined for these configuration files.
- Capability inventory: Executes Godot CLI commands via
subprocessand performs file system operations for test reports and game exports. - Sanitization: Standard path resolution is used; the skill relies on the Godot engine's own handling of project resources.
- [DYNAMIC_EXECUTION]: The guide for PlayGodot includes instructions for developers to manually build a custom Godot fork from source using the
sconsbuild system, which is routine for users needing specific engine-level automation features.
Audit Metadata