godot-master
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFE
Full Analysis
- [CORE_ARCHITECTURE]: The skill provides a robust architectural framework based on composition over inheritance and signal-driven communication. It includes several host-side Python utilities and Godot EditorPlugins designed to automate scene building and asset processing.
- [SECURITY_DEFENSE]: Multiple sections (Workflows 6, 9, and 11) explicitly warn the user and agent against security vulnerabilities such as JavaScript injection in web builds and arbitrary resource execution through unvalidated
load()calls. It provides remediation strategies like path sanitization and boundary markers for AI-generated data. - [DYNAMIC_EXECUTION]: The skill utilizes local Python scripts (e.g.,
builder_gltf_processor.py,agent_vision_capture.py) for development automation. These scripts are intended for host-side use during the development phase and do not involve remote code execution or suspicious obfuscation. - [DATA_PROTECTION]: The skill enforces best practices for secret management, specifically instructing users to store secrets in
.envfiles rather than hardcoding credentials. - [AUDIT_CAPABILITIES]: The 'Aurelius' auditor and 'Anara' analyst personas included in the skill are designed to scan user projects for technical debt, performance bottlenecks, and security risks (like
Expression.executesurfaces), acting as defensive tools.
Audit Metadata