scenario-godot-performance-export

Pass

Audited by Gen Agent Trust Hub on Oct 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The scripts/gd_perf.py module utilizes subprocess.run to interface with standard platform development and build tools, including godot, apksigner, aapt2, codesign, xcodebuild, ditto, spctl, keytool, brotli, and lipo.
  • [DYNAMIC_EXECUTION]: The Godot scripts perf_bench.gd and perf_stress.gd generate and reload GDScript resources at runtime. This mechanism is used to implement performance measurement sentinels and generate stress-test scenes with consistent logic.
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection as it ingests and processes Godot project files (project.godot, export_presets.cfg, and .tscn scene files) which could potentially contain malicious instructions if sourced from an untrusted project.
  • Ingestion points: Files are read in scripts/gd_perf.py and instantiated in perf_audit.gd and perf_fixes.gd.
  • Boundary markers: None detected in the data processing logic.
  • Capability inventory: The skill can execute shell commands, write to the file system, and execute Godot scripts.
  • Sanitization: No specific sanitization or validation of the ingested Godot project data was observed.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 17, 2026, 10:51 PM