skills/randroids-dojo/skills/godot/Gen Agent Trust Hub

godot

Pass

Audited by Gen Agent Trust Hub on Sep 21, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The helper scripts provided with the skill (export_build.py, run_tests.py, and validate_project.py) utilize the subprocess module to programmatically interact with the Godot engine. These scripts correctly pass arguments as a list to subprocess.run(), which is the standard secure practice to prevent command injection.
  • [EXTERNAL_DOWNLOADS]: The documentation and CI/CD examples reference several external resources and tools:
  • Fetches the Butler CLI tool from itch.io, which is a well-known game distribution service.
  • Downloads specialized automation builds of the Godot editor from the author's own GitHub repository (Randroids-Dojo/godot).
  • Installs community-standard Python packages (playgodot, pytest) and Node.js-based deployment tools (vercel, netlify-cli) from official registries.
  • [REMOTE_CODE_EXECUTION]: The skill documents setup procedures that involve executing remote code or binaries in a development context, such as installing the Butler CLI via a shelled script (curl | sh) and running the custom Godot editor binaries required for the PlayGodot framework.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to process Godot project files and scripts as part of its development workflow, which presents a surface for indirect instructions.
  • Ingestion points: Reads project.godot, export_presets.cfg, and project GDScript files.
  • Boundary markers: No specific boundary markers are defined for these configuration files.
  • Capability inventory: Executes Godot CLI commands via subprocess and performs file system operations for test reports and game exports.
  • Sanitization: Standard path resolution is used; the skill relies on the Godot engine's own handling of project resources.
  • [DYNAMIC_EXECUTION]: The guide for PlayGodot includes instructions for developers to manually build a custom Godot fork from source using the scons build system, which is routine for users needing specific engine-level automation features.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 21, 2026, 08:19 AM