steam-store-launch-ops
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from Steam store pages which could contain malicious instructions.\n
- Ingestion points: External Steam store URLs, screenshots, and page text are analyzed by the agent (file: SKILL.md).\n
- Boundary markers: The skill lacks explicit delimiters or instructions to treat external data as untrusted, which is necessary to prevent the agent from executing embedded commands.\n
- Capability inventory: The agent is authorized to use Bash, Read, Write, and Edit tools, which could be leveraged if the agent is influenced by malicious external input (file: SKILL.md).\n
- Sanitization: There are no specific requirements in the instructions to sanitize or validate the content retrieved from external sources.\n- [EXTERNAL_DOWNLOADS]: The skill references official Steamworks documentation for technical and marketing guidance.\n
- Evidence: Provides links to partner.steamgames.com for visibility, coming soon, demos, and release process documentation (file: SKILL.md).
Audit Metadata