gds-game-architecture
Pass
Audited by Gen Agent Trust Hub on Jul 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python script (
resolve_customization.py) during activation to merge configuration files. It also allows for the execution of arbitrary commands defined in theworkflow.activation_steps_prependandworkflow.activation_steps_appendfields within the user's project configuration. - [EXTERNAL_DOWNLOADS]: The skill provides detailed installation instructions and repository links for several third-party, community-maintained Game Engine MCP servers for Unity, Unreal, and Godot. These are presented as recommendations to the user to enhance AI-assisted development capabilities.
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface (Category 8) because it ingests and analyzes untrusted data from external files such as Game Design Documents (GDD), Epics, and Briefs. This analyzed content is used to generate project setup commands and influence architectural patterns.
- Ingestion points:
{output_folder}/*gdd*.md,*epic*.md,*brief*.md,*narrative*.md(processed in Step 2). - Boundary markers: None explicitly implemented; the skill assumes the technical integrity of the source documents.
- Capability inventory: Shell command execution via Python scripts and generation of setup commands for project initialization.
- Sanitization: No specific sanitization or filtering of instructions embedded within the game design documents was detected.
Audit Metadata