godot-autoload-architecture
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill implements dynamic resource loading and global service registration.
scripts/safe_scene_switcher.gdutilizesResourceLoader.load(path)to instantiate scenes from variable string paths, which is a standard scene management pattern in Godot.scripts/service_locator.gdandscripts/service_registry.gduseEngine.register_singletonto globally register objects at runtime, facilitating dependency injection.scripts/autoload_initializer.gdusesCallable.call()to execute registration callbacks during the boot sequence.- [INDIRECT_PROMPT_INJECTION]: The skill defines several ingestion points for untrusted data that could be influenced by external inputs in a complex agent pipeline.
- Ingestion points:
scripts/safe_scene_switcher.gd(pathparameter),scripts/service_locator.gd(idandproviderparameters), andscripts/service_registry.gd(service_nameparameter). - Boundary markers: None identified in the provided templates.
- Capability inventory:
ResourceLoader.load(),Engine.register_singleton(), andNode.add_child()across various scripts. - Sanitization: The scripts do not implement path validation or identifier sanitization, relying on the caller for safe input.
Audit Metadata