creating-shapes

Pass

Audited by Gen Agent Trust Hub on Oct 4, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill relies on the build(code=...) tool, which executes Python strings to generate Minecraft /setblock commands for complex shapes. The instructions provide several code templates (e.g., for spheres, cylinders, and pyramids) that are evaluated at runtime. The documentation notes that the execution environment is restricted, disallowing keywords like while, def, lambda, and most imports, while also enforcing command and iteration limits to prevent resource exhaustion.
  • [INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface by allowing the agent to generate and execute code based on user requests for specific shapes.
  • Ingestion points: The code argument in the build() tool calls within SKILL.md.
  • Boundary markers: Absent. The skill does not define specific delimiters for user-provided parameters used within the generated Python code.
  • Capability inventory: Includes the ability to execute sandboxed Python code (build) and perform Minecraft world modifications (worldedit_generation, worldedit_deform, /setblock).
  • Sanitization: The skill describes a server-side sandbox (disallowing certain Python features) but lacks explicit instructions for the AI agent to sanitize or validate user input before interpolating it into the code templates.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 4, 2026, 07:24 PM