game-ci-pipeline
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill includes templates that download the
butlerCLI utility directly from itch.io's official servers (broth.itch.ovh). This is a standard and expected operation for the skill's purpose of automating storefront deployments. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to automatically detect project engines and inject build versions by reading project configuration files such as
project.godot,ProjectVersion.txt, and*.uproject. This establishes a surface where data from the local repository is ingested and processed to generate shell commands or workflow files. - Ingestion points: Project files including
project.godot,*.unity,*.uproject,ProjectVersion.txt, andexport_presets.cfg. - Boundary markers: No explicit boundary markers or "ignore embedded instructions" warnings are utilized when the agent parses these local configuration files.
- Capability inventory: The skill utilizes
Bash,Write,Edit,Read,Glob, andGrepto execute builds, modify files, and manage workflow configurations. - Sanitization: The skill employs
sedto interpolate build versions into configuration files; while common in build automation, this requires that the version strings originate from trusted sources (like git tags).
Audit Metadata