{"data":{"skill":{"slug":"sickn33-godot-4-migration","name":"godot-4-migration","icon":"📦","repo":"https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/godot-4-migration","status":"approved","author":"sickn33","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"3e1efa25-c1b0-496f-8195-1512b64a737f","skill_id":"abd8e395-2432-4147-877f-3fd30602fb94","version":5,"content_hash":"v3:88a8e9a07f4c54ab105c1c41b6267c287146b07b:25dc21e45669bae0903c539f54672785e2338f9139ffca6225ab4dd45c520e15:91bb638eb23b64003436583790a9b15256e27aaea55afa4db0cd8af780eba051:736b696c6c732f7369636b6e33332f676f646f742d342d6d6967726174696f6e:a1b974bc0aca0c3fca83819069f749ac","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 33 external-command detections are Markdown backticks used for Godot names or fenced GDScript examples; none invokes a shell. The reconnaissance detection is an ordinary Godot error message, and no prompt injection or malicious intent appears in SKILL.md.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":13,"line_start":13},{"file":"SKILL.md","line_end":19,"line_start":19},{"file":"SKILL.md","line_end":20,"line_start":20},{"file":"SKILL.md","line_end":24,"line_start":24},{"file":"SKILL.md","line_end":26,"line_start":26},{"file":"SKILL.md","line_end":27,"line_start":27},{"file":"SKILL.md","line_end":28,"line_start":28},{"file":"SKILL.md","line_end":29,"line_start":29},{"file":"SKILL.md","line_end":41,"line_start":36},{"file":"SKILL.md","line_end":44,"line_start":41},{"file":"SKILL.md","line_end":51,"line_start":44},{"file":"SKILL.md","line_end":55,"line_start":51},{"file":"SKILL.md","line_end":55,"line_start":55},{"file":"SKILL.md","line_end":61,"line_start":58},{"file":"SKILL.md","line_end":64,"line_start":61},{"file":"SKILL.md","line_end":68,"line_start":64},{"file":"SKILL.md","line_end":75,"line_start":68},{"file":"SKILL.md","line_end":77,"line_start":75},{"file":"SKILL.md","line_end":80,"line_start":77},{"file":"SKILL.md","line_end":82,"line_start":80},{"file":"SKILL.md","line_end":90,"line_start":82},{"file":"SKILL.md","line_end":101,"line_start":90},{"file":"SKILL.md","line_end":105,"line_start":101},{"file":"SKILL.md","line_end":105,"line_start":105},{"file":"SKILL.md","line_end":110,"line_start":108},{"file":"SKILL.md","line_end":113,"line_start":110},{"file":"SKILL.md","line_end":115,"line_start":113},{"file":"SKILL.md","line_end":119,"line_start":115},{"file":"SKILL.md","line_end":119,"line_start":119},{"file":"SKILL.md","line_end":121,"line_start":120},{"file":"SKILL.md","line_end":121,"line_start":121},{"file":"SKILL.md","line_end":122,"line_start":122},{"file":"SKILL.md","line_end":127,"line_start":127}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":133,"audit_model":"codex","audited_at":"2026-07-24T00:30:06.576+00:00","created_at":"2026-07-26T13:24:50.880387+00:00","static_findings":[{"id":"external_commands:SKILL.md:13:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"A critical guide for developers transitioning from Godot 3.x to Godot 4. This skill focuses on the m","category":"external_commands","line_end":13,"severity":"medium","line_start":13},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Use when replacing deprecated nodes (like `Tween` node vs `create_tween`).","category":"external_commands","line_end":19,"severity":"medium","line_start":19},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Use when updating `export` variables to `@export` annotations.","category":"external_commands","line_end":20,"severity":"medium","line_start":20},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### 1. Annotations (`@`)","category":"external_commands","line_end":24,"severity":"medium","line_start":24},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Godot 4 uses `@` for keywords that modify behavior.","category":"external_commands","line_end":26,"severity":"medium","line_start":26},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `export var x` -> `@export var x`","category":"external_commands","line_end":27,"severity":"medium","line_start":27},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `onready var y` -> `@onready var y`","category":"external_commands","line_end":28,"severity":"medium","line_start":28},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `tool` -> `@tool` (at top of file)","category":"external_commands","line_end":29,"severity":"medium","line_start":29},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```gdscript","category":"external_commands","line_end":41,"severity":"medium","line_start":36},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":44,"severity":"medium","line_start":41},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```gdscript","category":"external_commands","line_end":51,"severity":"medium","line_start":44},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":55,"severity":"medium","line_start":51},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"The `Tween` node is deprecated. Use `create_tween()` in code.","category":"external_commands","line_end":55,"severity":"medium","line_start":55},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```gdscript","category":"external_commands","line_end":61,"severity":"medium","line_start":58},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":64,"severity":"medium","line_start":61},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```gdscript","category":"external_commands","line_end":68,"severity":"medium","line_start":64},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":75,"severity":"medium","line_start":68},{"id":"external_commands:SKILL.md:75:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```gdscript","category":"external_commands","line_end":77,"severity":"medium","line_start":75},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":80,"severity":"medium","line_start":77},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```gdscript","category":"external_commands","line_end":82,"severity":"medium","line_start":80},{"id":"external_commands:SKILL.md:82:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":90,"severity":"medium","line_start":82},{"id":"external_commands:SKILL.md:90:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```gdscript","category":"external_commands","line_end":101,"severity":"medium","line_start":90},{"id":"external_commands:SKILL.md:101:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":105,"severity":"medium","line_start":101},{"id":"external_commands:SKILL.md:105:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`yield` is replaced by `await`.","category":"external_commands","line_end":105,"severity":"medium","line_start":105},{"id":"external_commands:SKILL.md:108:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```gdscript","category":"external_commands","line_end":110,"severity":"medium","line_start":108},{"id":"external_commands:SKILL.md:110:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":113,"severity":"medium","line_start":110},{"id":"external_commands:SKILL.md:113:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```gdscript","category":"external_commands","line_end":115,"severity":"medium","line_start":113},{"id":"external_commands:SKILL.md:115:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":119,"severity":"medium","line_start":115},{"id":"external_commands:SKILL.md:119:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- ✅ **Do:** Use `@export_range`, `@export_file`, etc., for better inspector UI.","category":"external_commands","line_end":119,"severity":"medium","line_start":119},{"id":"external_commands:SKILL.md:120:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- ✅ **Do:** Type all variables (`var x: int`) for performance gains in GDScript 2.0.","category":"external_commands","line_end":121,"severity":"medium","line_start":120},{"id":"external_commands:SKILL.md:121:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- ✅ **Do:** Use `super()` to call parent methods instead of `.function_name()`.","category":"external_commands","line_end":121,"severity":"medium","line_start":121},{"id":"external_commands:SKILL.md:122:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- ❌ **Don't:** Use string names for signals (`emit_signal(\"name\")`) if you can use the signal object","category":"external_commands","line_end":122,"severity":"medium","line_start":122},{"id":"external_commands:SKILL.md:127:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Solution:** `Tween` is now `SceneTreeTween` or just an object returned by `create_tween()`. You ra","category":"external_commands","line_end":127,"severity":"medium","line_start":127},{"id":"blocker:SKILL.md:126:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"**Problem:** \"Identifier 'Tween' is not a valid type.\"","category":"blocker","line_end":126,"severity":"low","line_start":126}],"finding_verdicts":[{"id":"external_commands:SKILL.md:13:ruby-shell-backtick-execution","reason":"Line 13 uses inline Markdown backticks around Godot terms in descriptive prose; it does not execute a shell command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","reason":"Line 19 formats Tween API names with inline Markdown backticks; no command interpreter or execution instruction is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","reason":"Line 20 formats GDScript export syntax with inline Markdown backticks; it contains no shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","reason":"Line 24 uses backticks to format the GDScript annotation symbol in a heading; this is documentation only.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","reason":"Line 26 uses inline Markdown formatting for the annotation symbol and does not invoke an external process.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","reason":"Line 27 shows a GDScript export syntax conversion in inline code; neither example is a shell command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","reason":"Line 28 shows a GDScript onready syntax conversion in inline code; it has no command execution behavior.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","reason":"Line 29 documents the GDScript tool annotation with Markdown formatting; it does not execute the text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","reason":"Lines 36-41 are a fenced GDScript example of a Godot 3 property setter, not Ruby or shell code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","reason":"Lines 41-44 contain Markdown fence boundaries and a Godot version label; they do not invoke commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","reason":"Lines 44-51 are a fenced GDScript example of Godot 4 property accessors, with no shell semantics.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","reason":"Lines 51-55 close a Markdown fence and describe the Tween API; no external command is executed.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","reason":"Line 55 formats Godot class and method names as inline code; the prose only recommends a Godot API.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","reason":"Lines 58-61 are a fenced GDScript example using a Godot Tween node, not an operating-system command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","reason":"Lines 61-64 contain Markdown fence boundaries and a Godot version label; they do not execute commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","reason":"Lines 64-68 are a fenced GDScript Tween migration example and contain no shell or subprocess call.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","reason":"Lines 68-75 close a GDScript fence and introduce signal documentation; no external command behavior exists.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:75:ruby-shell-backtick-execution","reason":"Lines 75-77 are a fenced GDScript signal connection example, not executable shell content.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","reason":"Lines 77-80 contain Markdown fence boundaries and a Godot version label; there is no command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","reason":"Lines 80-82 are a fenced GDScript callable connection example and do not access an operating-system shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:82:ruby-shell-backtick-execution","reason":"Lines 82-90 close a GDScript fence and introduce typed arrays; the backticks are Markdown delimiters.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:90:ruby-shell-backtick-execution","reason":"Lines 90-101 are a fenced GDScript typed-array example with no process spawning or shell invocation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:101:ruby-shell-backtick-execution","reason":"Lines 101-105 close a GDScript fence and describe coroutine syntax; no external command is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:105:ruby-shell-backtick-execution","reason":"Line 105 formats two GDScript keywords as inline code and does not execute either keyword.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:108:ruby-shell-backtick-execution","reason":"Lines 108-110 are a fenced GDScript coroutine example for Godot 3, not shell code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:110:ruby-shell-backtick-execution","reason":"Lines 110-113 contain Markdown fence boundaries and a Godot version label; they do not invoke commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:113:ruby-shell-backtick-execution","reason":"Lines 113-115 are a fenced GDScript await example and contain no operating-system command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:115:ruby-shell-backtick-execution","reason":"Lines 115-119 close a Markdown fence and begin guidance about Godot annotations; no command runs.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:119:ruby-shell-backtick-execution","reason":"Line 119 formats Godot annotation names in prose; it only recommends inspector metadata.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:120:ruby-shell-backtick-execution","reason":"Lines 120-121 use inline code for GDScript typing and parent-method syntax; neither is a shell instruction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:121:ruby-shell-backtick-execution","reason":"Line 121 formats GDScript method-call syntax with backticks and contains no external process invocation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:122:ruby-shell-backtick-execution","reason":"Line 122 compares two GDScript signal APIs in inline code; it does not execute either example.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:127:ruby-shell-backtick-execution","reason":"Line 127 formats Godot type and method names as inline code within troubleshooting guidance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:126:system-reconnaissance","reason":"Line 126 quotes a Godot parser error about the Tween type; it gathers no system or environment information.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"88a8e9a07f4c54ab105c1c41b6267c287146b07b","subject_content_hash":"25dc21e45669bae0903c539f54672785e2338f9139ffca6225ab4dd45c520e15","subject_tree_hash":"91bb638eb23b64003436583790a9b15256e27aaea55afa4db0cd8af780eba051","subject_plugin_path":"skills/sickn33/godot-4-migration","audit_payload_hash":"a1b974bc0aca0c3fca83819069f749ac","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"88a8e9a07f4c54ab105c1c41b6267c287146b07b","contentHash":"25dc21e45669bae0903c539f54672785e2338f9139ffca6225ab4dd45c520e15","treeHash":"91bb638eb23b64003436583790a9b15256e27aaea55afa4db0cd8af780eba051","pluginPath":"skills/sickn33/godot-4-migration","auditPayloadHash":"a1b974bc0aca0c3fca83819069f749ac"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/sickn33-godot-4-migration/audits/5/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}