Treat it as code you must read first. A Godot script with the @tool annotation executes inside the editor, and Godot's own documentation warns that the editor has no protections against misuse of tool scripts. An addon that includes one runs with your editor's access.
What the Godot documentation says
Godot's page on running code in the editor explains that adding @tool at the top of a script makes it execute in the editor. It is meant for things like drawing a cannonball trajectory or showing a jump height while you design a level.
The page also carries a danger note: tool scripts run inside the editor and can access the scene tree of the scene being edited, and the editor does not include protections for potential misuse. The page's examples focus on crashes from freeing nodes at the wrong time. The security reading follows directly: code with that access, from a stranger, is a trust decision.
How to tell an editor plugin from a plain script pack
Godot's installing-plugins page offers a simple test. Some repositories call themselves plugins but are only scripts for use in a running project. An editor plugin has a plugin.cfg file in a folder under addons/. If that file is missing, you do not enable anything; you extract files into your project.
That distinction is useful for review. An editor plugin is enabled in Project Settings, on the Plugins tab, and then runs in the editor. Plain scripts run when your game runs them.
A short review checklist for an addon
- Find plugin.cfg and read which script it loads as the plugin entry point.
- Search the addon for the @tool annotation. List every file that has it.
- Read those files for anything that reaches outside the project: network requests, launching processes, writing files elsewhere on disk.
- Prefer a tagged release over a default branch download. Godot's docs themselves suggest using the Releases tab on GitHub when tags exist, because a tag was declared stable by its author.
- Record the addon name, version, source URL and review date in your inventory.
- Re-review on every update. A new version is new code.
Where addons come from
The Godot Asset Library labels each asset with a support level: Featured, Community or Testing. Featured assets are hand-picked. Community assets are submitted and maintained by community members. Testing assets are works in progress that may contain bugs and are not recommended for serious projects. These labels describe curation and maturity. They are not a security review, so do not read them as one.
If you want to see how asset library trust labels work on their own, the post on library support levels goes further.
Where Safeguard fits
Safeguard offers SBOM and dependency scanning, reachability analysis and policy gates for the dependencies a project declares, with a free scan at https://gold.safeguard.sh/scan. A scanner will not judge what a tool script intends to do, so keep this review in your own process for editor code.
Quick check
Does enabling an addon in Godot sandbox it?
Godot's documentation says the editor has no protections for potential misuse of tool scripts, so do not assume a sandbox.
How do I know whether a repo is an editor plugin?
Look for a plugin.cfg file inside a folder under addons/. If it is there, it is an editor plugin.
Sources
- Running code in the editor, Godot documentation
- Installing plugins, Godot documentation
- Using the Asset Library, Godot documentation
Last reviewed: 19 October 2026.
