godot-server-architecture
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines an attack surface for processing data from untrusted network peers (via UDP, RPC, and HTTP), which is inherent to its purpose as a server architecture tool.
- Ingestion points: Untrusted data enters the agent context through
scripts/safe_packet_decoder.gd(network packets),scripts/server_authority_validator.gd(RPC parameters), andscripts/server_matchmaker_client.gd(HTTP responses from a matchmaker). - Boundary markers: The skill proactively mitigates risks by mandating the use of
get_var(false)inscripts/safe_packet_decoder.gd, which prevents the engine from decoding objects that could lead to remote code execution. - Capability inventory: No dangerous system capabilities (e.g.,
OS.execute,FileAccesswrites to sensitive paths) are exposed or triggered by the processing of this data. - Sanitization: The skill utilizes standard Godot JSON parsing and secure binary serialization flags to handle external payloads.
- [DATA_EXFILTRATION]: The skill includes logic for communicating with external services.
- Evidence:
scripts/server_matchmaker_client.gdcontains anHTTPRequesttargetinghttps://api.game.com/v1/match. This is a placeholder URL for a matchmaking load balancer and does not involve the exfiltration of sensitive local data or credentials.
Audit Metadata