subnautica-ii-deep-synergy-multiplayer-mod
Pass
Audited by Gen Agent Trust Hub on May 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides numerous shell commands for the user to execute manually. These include standard file management (cd, ls, unzip), network connectivity tests (netstat, curl), and log monitoring (tail). These commands are consistent with the manual installation and troubleshooting of a BepInEx-based game mod.
- [EXTERNAL_DOWNLOADS]: The documentation directs users to download the BepInEx framework from its official GitHub repository and the mod itself from its release page. These references target well-known software distribution platforms.
- [PROMPT_INJECTION]: The mod's narrative generation feature (using OpenAI/Claude) represents an indirect prompt injection surface. The agent processes game context (e.g., "exploring thermal vents") or creature IDs to generate lore. While the current implementation focuses on text generation, the skill does not explicitly describe sanitization or boundary markers for this untrusted game data.
- Ingestion points: Game context strings provided via the
/synergy narratecommand and creature IDs used for lore generation. - Boundary markers: None identified in the provided configuration examples.
- Capability inventory: The mod hooks into Unity's IL2CPP runtime for game state synchronization but does not expose shell execution or file-write capabilities to the AI generation logic.
- Sanitization: No evidence of input validation or escaping for the game-derived context.
- [SAFE]: The skill correctly advises users to store sensitive API keys in environment variables (OPENAI_API_KEY, ANTHROPIC_API_KEY) rather than hardcoding them in configuration files, mitigating the risk of accidental credential exposure.
Audit Metadata