godot-genre-racing
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The instructions do not contain any patterns intended to bypass safety guidelines, override system behavior, or extract prompt information. The language is focused on game development technical patterns.
- [DATA_EXPOSURE_AND_EXFILTRATION]: No hardcoded credentials (API keys, tokens), sensitive local file paths (SSH, AWS configs), or unauthorized network exfiltration attempts were detected.
- [OBFUSCATION]: The skill uses clear, plain-text instructions and code. No hidden content, such as zero-width characters, homoglyphs, or base64-encoded strings, was found.
- [REMOTE_CODE_EXECUTION]: The skill does not download or execute scripts from external sources at runtime. Dependencies are references to other skills within the vendor's own GitHub organization.
- [DYNAMIC_EXECUTION]: The scripts use standard Godot binary serialization (FileAccess.store_var) in 'ghost_recorder.gd' for local storage of transform data. This is a legitimate game development pattern and does not involve executing code from untrusted external inputs.
- [DYNAMIC_CONTEXT_INJECTION]: No shell command execution placeholders (!command`) were found in the skill metadata or instructions.
- [PRIVILEGE_ESCALATION]: No commands requiring elevated permissions, such as sudo or chmod 777, were identified.
- [PERSISTENCE]: The skill does not attempt to modify system startup files, shell profiles, or scheduled tasks.
Audit Metadata