godot-genre-fighting
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The MoveSetLoader class in scripts/move_set_loader.gd provides a mechanism to ingest move-set data from external JSON files, which represents an attack surface for indirect prompt injection.\n
- Ingestion points: The load_from_json method in scripts/move_set_loader.gd reads data from a user-provided file path.\n
- Boundary markers: Absent; the skill does not include instructions or delimiters to mark the ingested data as untrusted or separate from instructions.\n
- Capability inventory: The skill possesses file read capabilities via FileAccess and data parsing via JSON.parse_string, which can be triggered by the agent's actions.\n
- Sanitization: Absent; the loader lacks validation or sanitization of the JSON content, relying on the structure of the external file without schema verification.
Audit Metadata