setup-engine
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns or significant security risks were identified. The skill functions as a configuration utility that manages project metadata and technical documentation.
- [INDIRECT_PROMPT_INJECTION]: The skill includes functionality to read existing project files, such as
game-concept.md, to inform its engine recommendations. This creates a standard indirect prompt injection surface where external data enters the agent's context. - Ingestion points:
design/gdd/game-concept.md(read in Section 2 to determine engine needs). - Boundary markers: Absent; the instructions do not specify the use of delimiters when reading external content.
- Capability inventory: The skill has access to
Write,Edit,WebSearch,WebFetch, andTaskacross several configuration files. - Sanitization: No explicit sanitization or filtering of the ingested game concept data is described, though the output is primarily used for recommendation logic and documentation rather than direct command execution.
- [EXTERNAL_DOWNLOADS]: The skill uses
WebSearchandWebFetchto retrieve engine versions and migration guides. These operations target well-known engine documentation sources to populate project reference files and do not involve downloading or executing untrusted binaries or scripts.
Audit Metadata