gamedev-steam-publish

Pass

Audited by Gen Agent Trust Hub on Oct 12, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides instructions and command-line patterns for executing steamcmd, a command-line utility for uploading game builds to Steam. Evidence includes:
  • Command templates for logging in and running build scripts: steamcmd.exe +login <build_account> <password> +run_app_build ..\scripts\app_build_1000.vdf +quit.
  • Guidance on setting the executable permissions on macOS: chmod +x steamcmd.
  • [EXTERNAL_DOWNLOADS]: The skill references the download and bootstrapping of the Steamworks SDK and the steamcmd tool, which is a standard requirement for the Steam publishing workflow. It notes that the tool self-updates upon its first execution.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to process and manage external Valve KeyValues (VDF) build scripts, which represents a surface for indirect prompt injection if the agent is instructed to process scripts from untrusted sources.
  • Ingestion points: The agent reads and interprets app_build_*.vdf and depot_build_*.vdf files to manage the SteamPipe workflow.
  • Boundary markers: None present; the skill assumes user-authored or project-specific scripts.
  • Capability inventory: The skill uses steamcmd for command execution, manages directory structures, and handles file mapping for depots.
  • Sanitization: Not explicitly defined, as the skill provides templates for standard industry usage.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 12, 2026, 08:01 PM