scenario-godot-performance-export
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/gd_perf.pymodule utilizessubprocess.runto interface with standard platform development and build tools, includinggodot,apksigner,aapt2,codesign,xcodebuild,ditto,spctl,keytool,brotli, andlipo. - [DYNAMIC_EXECUTION]: The Godot scripts
perf_bench.gdandperf_stress.gdgenerate and reloadGDScriptresources at runtime. This mechanism is used to implement performance measurement sentinels and generate stress-test scenes with consistent logic. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection as it ingests and processes Godot project files (
project.godot,export_presets.cfg, and.tscnscene files) which could potentially contain malicious instructions if sourced from an untrusted project. - Ingestion points: Files are read in
scripts/gd_perf.pyand instantiated inperf_audit.gdandperf_fixes.gd. - Boundary markers: None detected in the data processing logic.
- Capability inventory: The skill can execute shell commands, write to the file system, and execute Godot scripts.
- Sanitization: No specific sanitization or validation of the ingested Godot project data was observed.
Audit Metadata