godot-genre-rhythm
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill exposes a potential attack surface through untrusted data ingestion.
- Ingestion points: The
ChartLoaderclass inreferences/rhythm-systems-deep.mdreads external beatmap files usingFileAccess.open(chart_path, FileAccess.READ)and processes them line-by-line. - Boundary markers: None identified; the skill assumes chart files follow a specific CSV-like format.
- Capability inventory: The skill includes file-read operations (
FileAccess) and UI management, but lacks dangerous capabilities like network exfiltration or arbitrary subprocess execution. - Sanitization: The skill performs basic type casting (converting string parts to
floatorint) but does not implement strict schema validation for the external chart data.
Audit Metadata