game-qa-lead
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructions require the agent to ingest and act upon external documentation and user-provided reports, creating a surface for injection attacks.
- Ingestion points: The agent analyzes Game Design Documents (GDD), technical architecture diagrams, sprint goals, and player-submitted bug reports (SKILL.md).
- Boundary markers: There are no instructions for using delimiters or 'ignore embedded instructions' markers when processing these external sources.
- Capability inventory: The skill has access to
Bash,Write,Edit,Read,Grep, andGlob(specified in theallowed-toolsfrontmatter). - Sanitization: The skill lacks protocols for sanitizing, validating, or escaping content found in project documents or bug reports before using them to drive agent actions.
Audit Metadata