setup-engine

Pass

Audited by Gen Agent Trust Hub on Jul 10, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: No malicious patterns or significant security risks were identified. The skill functions as a configuration utility that manages project metadata and technical documentation.
  • [INDIRECT_PROMPT_INJECTION]: The skill includes functionality to read existing project files, such as game-concept.md, to inform its engine recommendations. This creates a standard indirect prompt injection surface where external data enters the agent's context.
  • Ingestion points: design/gdd/game-concept.md (read in Section 2 to determine engine needs).
  • Boundary markers: Absent; the instructions do not specify the use of delimiters when reading external content.
  • Capability inventory: The skill has access to Write, Edit, WebSearch, WebFetch, and Task across several configuration files.
  • Sanitization: No explicit sanitization or filtering of the ingested game concept data is described, though the output is primarily used for recommendation logic and documentation rather than direct command execution.
  • [EXTERNAL_DOWNLOADS]: The skill uses WebSearch and WebFetch to retrieve engine versions and migration guides. These operations target well-known engine documentation sources to populate project reference files and do not involve downloading or executing untrusted binaries or scripts.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 10, 2026, 09:20 PM