T08 · Insecure Dependencies
Warning
- Location
SKILL.md:27- Finding
Unpinned Third-Party Godot Plugin Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
Godot MCP Integration
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent Godot editor automation guide, but it installs mutable third-party plugin code and enables AI-driven project file changes without enough safety scoping or rollback guidance.
Install only in a trusted local Godot project, preferably under version control with backups. Review the upstream plugin source before enabling it, pin to a specific commit or signed release where possible, prefer project-level MCP configuration over user-level configuration, and require explicit approval before AI actions that write, overwrite, delete, or batch-modify project files.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill instructs users to connect AI clients directly to a local MCP server over HTTP without explaining that prompts, project files, scene structure, logs, and editor state may be transmitted through that channel. Although bound to 127.0.0.1, this still expands the attack surface to local processes and connected AI tools, and users may not realize sensitive project data can be exposed or relayed onward by the client.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill explicitly advertises file write and delete capabilities inside a live Godot project but does not warn users that AI-driven actions can overwrite assets, scripts, scenes, or remove files irreversibly. In this context, the omission is security-relevant because the skill encourages direct editor and filesystem automation, increasing the chance of destructive or unintended modifications from prompt mistakes or model misuse.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This API reference exposes numerous write-capable and destructive operations, including script/file writes, file deletion, scene/node deletion, and project resource mutation, without any warning about irreversible changes, confirmation requirements, or safe-use guidance. In the context of an MCP skill that lets an AI assistant directly control the Godot editor and project files, that omission increases the risk of accidental or prompt-induced destructive actions against source code and assets.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This example demonstrates direct file-writing via script creation and script_write into project resources without any caution that the operation modifies project files. In the context of an MCP skill that lets an AI assistant control the Godot editor, examples strongly influence agent behavior; omission of safety guidance can lead to unreviewed writes, overwriting existing scripts, or persistence of unintended code changes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The batch-operation and filesystem examples encourage repeated scene creation, scene saving, property mutation, and filesystem writes across the project without any warning about scope, overwrite risk, or need for user confirmation. Because this skill is specifically designed to let AI clients automate editor and filesystem actions at scale, such examples normalize project-wide modifications that could rapidly cause destructive or hard-to-review changes.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The file forces a specific language presentation throughout the skill documentation and does not indicate that users may choose another language or that the locale constraint is intentional and justified. This matches the language or locale policy violation category for natural-language policy issues.
- Content
Static analysis
No suspicious patterns detected.