scenario-godot-audio
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/gd_audio.pyutilizessubprocess.runto execute system utilitiesffmpegandffprobe. These tools are used for legitimate audio analysis, normalization, and conversion tasks essential to the skill's functionality. The implementation uses list-style arguments to mitigate shell injection risks. - [DYNAMIC_EXECUTION]: In
scripts/agentkit/audio/audio_buses.gd, the skill uses Godot'sClassDB.instantiate()to dynamically createAudioEffectnodes based on a provided configuration dictionary. This is a standard Godot pattern for data-driven design and is constrained to classes within the engine's effect database. - [INDIRECT_PROMPT_INJECTION]: The skill's workflow includes processing external audio assets, such as AI-generated music and sound effects. This creates an attack surface typical for any media-processing tool, where maliciously crafted files could potentially target the underlying analysis libraries (
ffmpeg/ffprobe). The skill includes procedures for 'conditioning' and auditing these assets before use.
Audit Metadata