godot-platform-web
Pass
Audited by Gen Agent Trust Hub on Feb 16, 2026
Risk Level: LOWCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION] (LOW): The GDScript templates include examples of JavaScriptBridge.eval() calls. Evidence: The save_to_browser function uses string interpolation (%s) to build a JavaScript command in SKILL.md. Risk: This pattern is vulnerable to injection. If the data variable contains unescaped characters or malicious scripts, it would result in arbitrary JavaScript execution in the browser context of the exported game.
Audit Metadata