game-ci-pipeline

Pass

Audited by Gen Agent Trust Hub on Sep 19, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill includes templates that download the butler CLI utility directly from itch.io's official servers (broth.itch.ovh). This is a standard and expected operation for the skill's purpose of automating storefront deployments.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to automatically detect project engines and inject build versions by reading project configuration files such as project.godot, ProjectVersion.txt, and *.uproject. This establishes a surface where data from the local repository is ingested and processed to generate shell commands or workflow files.
  • Ingestion points: Project files including project.godot, *.unity, *.uproject, ProjectVersion.txt, and export_presets.cfg.
  • Boundary markers: No explicit boundary markers or "ignore embedded instructions" warnings are utilized when the agent parses these local configuration files.
  • Capability inventory: The skill utilizes Bash, Write, Edit, Read, Glob, and Grep to execute builds, modify files, and manage workflow configurations.
  • Sanitization: The skill employs sed to interpolate build versions into configuration files; while common in build automation, this requires that the version strings originate from trusted sources (like git tags).
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 19, 2026, 07:23 AM