godot-version-migration
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns, obfuscation, or unauthorized data access were detected. The skill primarily consists of markdown documentation and migration notes.
- [PROMPT_INJECTION]: No attempts to override agent behavior or bypass safety guidelines were found. The instructional constraints (e.g., 'NEVER skip majors') are legitimate safety measures for project migration integrity.
- [EXTERNAL_DOWNLOADS]: The skill references official Godot documentation and GitHub repositories. It also links to a community-maintained repository for legacy version migration (dploeger/godot-migrationnotes). These are documented neutrally as informative resources for the migration process.
- [INDIRECT_PROMPT_INJECTION]: The skill identifies a project's engine version by reading local configuration files (project.godot, engine.cfg). While this is a standard ingestion point for Godot project management, it represents an inherent surface for indirect prompt injection if the processed project files were to contain malicious instructions designed to influence the agent.
- Ingestion points: project.godot and engine.cfg (identified in SKILL.md).
- Boundary markers: None explicitly specified for reading these files.
- Capability inventory: The agent is expected to use standard file manipulation tools to apply migration fixes and update configuration based on the hub's notes.
- Sanitization: Not explicitly defined; the agent processes content from the local file system using provided migration logic.
Audit Metadata