godot-bridge

`writeProjectFile` passes its own policy instead of the deployment default (the code comment says the fs service applies the deployment policy only when none is passed). `projectPath` comes straight from tool arguments (`godot_set_project_setting`, `godot_manage_autoloads`, `godot_manage_input_map`, `godot_create_script`, `godot_create_project`, and `ensureInteractionAutoload` via `godot_run_project`). A prompt-injected model can therefore root the write policy at any directory the user can write (e.g. a home directory or another project), overwriting `project.godot`, `export_presets.cfg`, `au

`godot_run_headless`, `godot_export_project` and `godot_run_project` accept `godot_path` from the model ('pass the godot_path tool argument') and spawn it outside the file sandbox (the plugin's own prompt section advertises the unconfined subprocess channel). A prompt-injected model can point `godot_path` at any executable or script that tolerates the appended `--headless --path ...` arguments, running it with the user's privileges. There is no shell-string construction (argv only), so this is path/argument abuse, not shell injection.

Every plugin load performs an outbound request without user action or opt-out. `UPDATE_SOURCE` is derived from the installed `package.json` `repository` URL (documented as following forks), so whoever controls that repository's `main` branch controls the `version` string; only the numeric prefix is compared, while the raw string is concatenated into an imperative system-prompt section shown to the model in every session. This is a supply-chain prompt-injection channel (requires upstream compromise or a fork pointed at an attacker repo), plus undisclosed telemetry-grade network traffic.

`findLegacyGodotPath` uses raw `node:fs.readFileSync` (bypassing `ctx.fs` policy) to load the whole DSH settings file, which may contain unrelated configuration/secrets, although only the `godot-bridge.godotPath` line is used. `restoreLegacyGodotPath` then writes to the profile's `cordis.patch.yml` during `apply`, i.e. a persistent configuration change without user action. No data leaves the machine.

`ensureDir` performs filesystem mutation by spawning a Node process instead of the policy-checked `ctx.fs` service, and `dir` is derived from model-supplied `project_path`/`script_path` (including `../` segments in `godot_create_script`). Impact is limited to directory creation (file contents still go through the fs policy), but it is an uncontrolled write primitive outside the declared sandbox.