skills/akillness/jeo-skills/godogen/Gen Agent Trust Hub

godogen

Pass

Audited by Gen Agent Trust Hub on Aug 26, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process "game descriptions" or "briefs" from users to build autonomous games. This creates a vulnerability surface where instructions embedded in the untrusted data (the brief) could attempt to influence the agent's behavior during the build process.
  • Ingestion points: Processes user-provided game descriptions in SKILL.md.
  • Boundary markers: Absent; the skill does not specify delimiters or sanitization protocols for the user's brief.
  • Capability inventory: Extensive access to Bash, Write, git, rsync, and engine toolchains (dotnet, cargo, npm) across all referenced scripts.
  • Sanitization: Absent; the skill relies on visual proof (watched video) as the primary verification gate rather than input sanitization.
  • [DYNAMIC_EXECUTION]: The skill orchestrates the runtime generation of C# scenes, Bevy binaries, and TypeScript projects. It uses standard build tools (dotnet build, cargo build, npm run build) to compile and execute source code that is generated dynamically from templates and user inputs.
  • [COMMAND_EXECUTION]: The skill uses shell commands (bash, rsync, git) for environment verification, project publication, and lifecycle management. It includes a specific doctor script (scripts/godogen.sh) to preflight host toolchains and rendering paths.
  • [EXTERNAL_DOWNLOADS]: The skill downloads the Godogen source repository and its associated instructions from github.com/htdt/godogen. It also facilitates the installation of dependencies through official package managers (pip, npm, cargo) as part of the game delivery process.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 26, 2026, 11:32 PM
Security Audit — agent-trust-hub — godogen