gds-ux
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: During its activation phase, the skill directs the agent to execute a local Python script
resolve_customization.pyusing theuv runcommand. This script is part of the vendor-managed_bmaddirectory within the project root and is used for configuration resolution. - [COMMAND_EXECUTION]: The creative tools and validation synthesis modules utilize platform-specific shell commands, including
open(macOS),xdg-open(Linux), andstart(Windows). These are used to automatically display generated HTML mockups and reports in the user's default browser. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external planning documents such as Product Requirement Documents (PRDs) and Game Design Documents (GDDs). This represents a standard surface for indirect prompt injection, as malicious instructions embedded within these documents could potentially influence the agent's interpretation of the project goals.
Audit Metadata