godot-genre-rhythm
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides logic for loading and parsing external chart/beatmap data files which creates an attack surface for indirect prompt injection.\n
- Ingestion points: The
ChartLoader.load_chartfunction inreferences/rhythm-systems-deep.mdreads and parses data from files using theFileAccess.openAPI.\n - Boundary markers: The implementation does not use delimiters or include instructions for the agent to ignore potentially malicious content embedded within the chart files.\n
- Capability inventory: The skill utilizes file system read capabilities (
FileAccess.READ), audio manipulation (AudioStreamPlayer), and visual object instantiation.\n - Sanitization: The parsing logic does not perform validation or escaping of the ingested strings before they are used to define game behavior.
Audit Metadata