gamedev-steam-publish
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions and command-line patterns for executing
steamcmd, a command-line utility for uploading game builds to Steam. Evidence includes: - Command templates for logging in and running build scripts:
steamcmd.exe +login <build_account> <password> +run_app_build ..\scripts\app_build_1000.vdf +quit. - Guidance on setting the executable permissions on macOS:
chmod +x steamcmd. - [EXTERNAL_DOWNLOADS]: The skill references the download and bootstrapping of the Steamworks SDK and the
steamcmdtool, which is a standard requirement for the Steam publishing workflow. It notes that the tool self-updates upon its first execution. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process and manage external Valve KeyValues (VDF) build scripts, which represents a surface for indirect prompt injection if the agent is instructed to process scripts from untrusted sources.
- Ingestion points: The agent reads and interprets
app_build_*.vdfanddepot_build_*.vdffiles to manage the SteamPipe workflow. - Boundary markers: None present; the skill assumes user-authored or project-specific scripts.
- Capability inventory: The skill uses
steamcmdfor command execution, manages directory structures, and handles file mapping for depots. - Sanitization: Not explicitly defined, as the skill provides templates for standard industry usage.
Audit Metadata