godot-state-machine-advanced

Pass

Audited by Gen Agent Trust Hub on Oct 12, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The hsm_resource_state_loader.gd script utilizes the set_script() method to dynamically assign scripts to nodes at runtime. While this is the intended functionality for data-driven AI state management in Godot, it represents a dynamic code loading surface where logic is determined by external resource files.
  • Evidence: state_node.set_script(res.state_script) found in scripts/hsm_resource_state_loader.gd.
  • [INDIRECT_PROMPT_INJECTION]: The skill implements a data-driven loading system that processes Godot Resource files (.tres) to define AI behavior, creating a potential surface for indirect injection if these resources are sourced from untrusted third parties.
  • Ingestion points: The initialize_states() function in scripts/hsm_resource_state_loader.gd processes the state_resources array.
  • Boundary markers: No explicit delimiters or instructions to ignore embedded content were found in the processing logic.
  • Capability inventory: The system has the capability to modify node behavior via set_script() in scripts/hsm_resource_state_loader.gd and execute logic via physics_update() and handle_input() across multiple scripts.
  • Sanitization: There is no evidence of script validation or integrity checking before the script is assigned to the node.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 12, 2026, 05:04 AM