godot-autoload-architecture

Pass

Audited by Gen Agent Trust Hub on Oct 14, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill implements dynamic loading and instantiation of scene resources which is standard for game engine architecture.
  • Evidence: scripts/safe_scene_switcher.gd uses ResourceLoader.load(path) and instantiate() to transition between game scenes at runtime.
  • Evidence: scripts/autoload_bootstrapper.gd and scripts/autoload_initializer.gd utilize dynamic method calls (call()) and Callable execution to manage service initialization cycles across nodes.
  • [INDIRECT_PROMPT_INJECTION]: The scene management system provides an attack surface for indirect injection if scene paths are derived from untrusted inputs, although the provided patterns are intended for developer-controlled transitions.
  • Ingestion points: The goto_scene(path: String) function in scripts/safe_scene_switcher.gd accepts string paths to load and instantiate new scenes.
  • Boundary markers: Absent in the provided scripts; there are no explicit delimiters or instructions to ignore embedded content in the resources being loaded.
  • Capability inventory: The skill has the capability to load filesystem resources, instantiate scene trees, and modify the root SceneTree children.
  • Sanitization: No sanitization or path validation logic is implemented in the reference scripts; the pattern assumes the provided paths are valid internal project resources.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 14, 2026, 09:25 AM