creating-shapes
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill relies on the
build(code=...)tool, which executes Python strings to generate Minecraft/setblockcommands for complex shapes. The instructions provide several code templates (e.g., for spheres, cylinders, and pyramids) that are evaluated at runtime. The documentation notes that the execution environment is restricted, disallowing keywords likewhile,def,lambda, and most imports, while also enforcing command and iteration limits to prevent resource exhaustion. - [INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface by allowing the agent to generate and execute code based on user requests for specific shapes.
- Ingestion points: The
codeargument in thebuild()tool calls withinSKILL.md. - Boundary markers: Absent. The skill does not define specific delimiters for user-provided parameters used within the generated Python code.
- Capability inventory: Includes the ability to execute sandboxed Python code (
build) and perform Minecraft world modifications (worldedit_generation,worldedit_deform,/setblock). - Sanitization: The skill describes a server-side sandbox (disallowing certain Python features) but lacks explicit instructions for the AI agent to sanitize or validate user input before interpolating it into the code templates.
Audit Metadata