building-era-authentic-game-audio
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a local Node.js validation utility (
scripts/validate-audio-kit.mjs) and instructs the agent to run it. The script is self-contained, using only built-in Node.js modules (fs,os,path,url) to perform technical validation of audio manifests without external dependencies or dangerous system calls.\n- [INDIRECT_PROMPT_INJECTION]: The skill defines an attack surface by ingesting user-providedmanifest.jsonfiles. This is mitigated by a mandatory evidence chain: 1. Ingestion point:validate-audio-kit.mjsviafs.readFileSync. 2. Boundary markers: The script acts as a formal validator between the data and the agent. 3. Capability inventory: Access is limited to reading the manifest and logging to the console. 4. Sanitization: The script performs exhaustive type, range, and consistency checks on all input fields, preventing malformed data from influencing the agent's summary.
Audit Metadata