scenario-godot-2d

Pass

Audited by Gen Agent Trust Hub on Oct 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The Python helper script gd_2d.py modifies Godot project configuration files (project.godot) and .import metadata files to automate pixel-art settings and asset management. These actions are limited to local project files within the skill's scope.
  • [DYNAMIC_EXECUTION]: The audit_2d.gd script uses Godot's instantiate() method to inspect scenes. This process dynamically executes script code (such as _ready() functions) within those scenes to perform its analysis, which is standard behavior for Godot-based development tools.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes project assets like scene files (.tscn), image files, and JSON manifests, which theoretically could contain indirect instructions.
  • Ingestion points: audit_2d.gd (scenes), sprite_frames_builder.gd (JSON manifests), and gd_2d.py (images).
  • Boundary markers: None identified in the asset processing scripts.
  • Capability inventory: Scripts can modify project resources and instantiate scenes (executing their logic).
  • Sanitization: Standard parsing is used, but there is no specific sanitization for adversarial content within project assets.
  • [EXTERNAL_DOWNLOADS]: Documentation in SKILL.md and gd_2d.py provides instructions for the user to install dependencies, such as the pillow Python library and sister skills from the official scenario-labs repository, using standard package managers.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 18, 2026, 08:52 AM