game-ui-ux
Pass
Audited by Gen Agent Trust Hub on Aug 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data in the form of a
game-ui-contract.jsonfile, which creates a potential surface for instructions embedded in data. - Ingestion points: The agent reads and analyzes the user-provided
game-ui-contract.jsonfile as part of the primary workflow (Step 8). - Boundary markers: The skill does not employ explicit delimiters or system instructions to distinguish between data and potential commands within the contract file.
- Capability inventory: The skill has the ability to execute shell commands (
Bash), read/write files, and perform network requests (WebFetch) via its allowed tools. - Sanitization: A Python validation script (
scripts/validate-game-ui.py) is used to check for placeholders and schema compliance, but it does not sanitize the content for adversarial prompt patterns. - [EXTERNAL_DOWNLOADS]: The skill references external documentation and technical guidelines from well-known services and organizations, including Microsoft (Xbox Accessibility Guidelines), Unity Technologies, Godot Engine, and the W3C (WCAG). These resources are used to inform the design and accessibility of the UI contract.
- [COMMAND_EXECUTION]: The skill utilizes a local Python script (
scripts/validate-game-ui.py) to validate the structure and content of the game UI contracts. Technical analysis of the script confirms it is restricted to the Python standard library and performs read-only operations on the target JSON file to ensure schema compliance.
Audit Metadata