Skills
Navigate
skills/scenario-labs/skills/scenario-godot-multiplayer/Gen Agent Trust Hub

scenario-godot-multiplayer

Pass

Audited by Gen Agent Trust Hub on Oct 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/gd_net.py uses subprocess.run to call rsync for cloning project directories and subprocess.Popen to launch the Godot engine for multi-role game sessions.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes network data received from peers via Godot's RPC system in scripts/agentkit/multiplayer/net_lab.gd. This represents an attack surface for indirect prompt injection if malicious payloads are included in game logs reviewed by the agent.\n
  • Ingestion points: scripts/agentkit/multiplayer/net_lab.gd receives RPC data and synchronizer updates from external peers.\n
  • Boundary markers: No explicit delimiters or instructions are used to separate untrusted peer data in logs.\n
  • Capability inventory: scripts/gd_net.py possesses capabilities for shell command execution and local file manipulation.\n
  • Sanitization: The skill performs logic-based validation (e.g., teleport distance) but lacks generic sanitization for string-based network payloads.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 18, 2026, 08:55 AM