godot-ui-rich-text
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted user-generated strings (e.g., from chat or lobby systems) for rendering in Godot's RichTextLabel, creating a surface for BBCode injection or unexpected UI behavior.\n
- Ingestion points: Public chat interfaces and player-typed inputs are identified as sources in
SKILL.mdand handled byrich_text_bbcode_sanitizer.gd.\n - Boundary markers: The skill documentation includes a mandatory requirement for developers to use the provided sanitizer script before assigning user input to a label.\n
- Capability inventory: The included scripts provide functionality for UI rendering, custom RichTextEffect animations (rainbow, glitch), and dialogue event signaling through
RichTextMetaDispatchandRichTextTypewriterController.\n - Sanitization: The skill provides a
RichTextBBCodeSanitizerclass that uses a regular-expression-based allow-list approach to strip unauthorized tags from input strings.
Audit Metadata