godot-state-machine-advanced
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The script scripts/hsm_resource_state_loader.gd implements a data-driven state loader that uses the set_script() method to attach logic to nodes at runtime based on Godot Resource files (.tres). While standard in game development, this represents a surface for dynamic code loading. Evidence: state_node.set_script(res.state_script) in scripts/hsm_resource_state_loader.gd.
- [INDIRECT_PROMPT_INJECTION]: The skill exposes an attack surface where untrusted state definitions could influence agent behavior if the agent processes malicious project resources. Ingestion points: The state_resources export array in scripts/hsm_resource_state_loader.gd. Boundary markers: Absent; resource data is treated as trusted internal configuration. Capability inventory: Includes dynamic script execution via set_script, scene tree management via add_child, and physics/input lifecycle delegation. Sanitization: Absent; the implementation assumes resources provided to the loader are verified project components.
Audit Metadata