Audit History
godot-gdscript-patterns - 8 audits
Version comparison
Capability and finding changes across audited versions, newest first.
| Version | Date | Result | Review items | Change vs previous |
|---|---|---|---|---|
| v8 Latest | Jul 9, 2026, 12:39 PM | No confirmed findings | 1 | No capability change |
| v7 | Jul 9, 2026, 12:39 PM | No confirmed findings | 1 | No capability change |
| v6 | Jul 7, 2026, 07:13 AM | No confirmed findings | 1 | External commandsNetwork accessEnv variables Filesystem access |
| v5 | Jul 1, 2026, 12:58 AM | 1 confirmed | 0 | Filesystem access Network accessExternal commandsEnv variables |
| v4 | Jan 17, 2026, 09:10 AM | No confirmed findings | 0 | No capability change |
| v3 | Jan 17, 2026, 09:10 AM | No confirmed findings | 0 | Network accessExternal commandsEnv variables |
| v2 | Jan 4, 2026, 04:27 PM | No confirmed findings | 0 | No capability change |
| v1 | Jan 4, 2026, 04:27 PM | No confirmed findings | 0 | Baseline |
Jul 9, 2026, 12:39 PM
Most static hits are false positives caused by Markdown code fences, Godot resource-loading APIs, documentation URLs, and local node-path usage. One confirmed issue remains: the save-system example hardcodes an encryption key placeholder and passes it to encrypted file storage. No prompt injection text was found in SKILL.md.
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Risk Factors
⚙️ External commands (38)
🌐 Network access (4)
🔑 Env variables (1)
Jul 9, 2026, 12:39 PM
Most static hits are false positives caused by Markdown code fences, Godot resource-loading APIs, documentation URLs, and local node-path usage. One confirmed issue remains: the save-system example hardcodes an encryption key placeholder and passes it to encrypted file storage. No prompt injection text was found in SKILL.md.
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Risk Factors
⚙️ External commands (38)
🌐 Network access (4)
🔑 Env variables (1)
Jul 7, 2026, 07:13 AM
Most static findings are false positives caused by Markdown fences, GDScript examples, and documentation links. The only confirmed issue is a sample save system that hardcodes a placeholder encryption key, which can teach unsafe secret handling if copied into production.
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Risk Factors
⚙️ External commands (38)
🌐 Network access (4)
🔑 Env variables (1)
Jul 1, 2026, 12:58 AM
Static analysis reported command execution, network access, environment access, weak crypto, reconnaissance, and a critical combination heuristic. Most alerts are false positives from markdown GDScript examples, local Godot APIs, headings, and reference links. The only actionable issue is a save-system example that teaches a hardcoded encryption passphrase.
Confirmed security concerns (1)
Static false positives ignored (5)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Risk Factors
📁 Filesystem access (3)
Detected Patterns
Jan 17, 2026, 09:10 AM
This skill is documentation-only with GDScript code examples for Godot 4 game development. All static findings are false positives - there is no executable code, no network access, and no credential exfiltration. The static scanner misinterpreted markdown code block markers as shell backticks and placeholder documentation examples as security issues.
Risk Factors
🌐 Network access (4)
⚙️ External commands (38)
🔑 Env variables (1)
Jan 17, 2026, 09:10 AM
This skill is documentation-only with GDScript code examples for Godot 4 game development. All static findings are false positives - there is no executable code, no network access, and no credential exfiltration. The static scanner misinterpreted markdown code block markers as shell backticks and placeholder documentation examples as security issues.
Risk Factors
🌐 Network access (4)
⚙️ External commands (38)
🔑 Env variables (1)
Jan 4, 2026, 04:27 PM
The skill is documentation-only with examples in SKILL.md and two metadata JSON files. No executable code, network calls, or system access found. Safe to publish.
Jan 4, 2026, 04:27 PM
The skill is documentation-only with examples in SKILL.md and two metadata JSON files. No executable code, network calls, or system access found. Safe to publish.