shader-gen
Pass
Audited by Gen Agent Trust Hub on Oct 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied strings via the prompt parameter in the submit_shader tool to generate code (SKILL.md). Ingestion points: submit_shader tool prompt. Boundary markers: Absent. Capability inventory: submit_shader, edit_asset, and edit_item tools. Sanitization: Backend validation including transpilation and AST-based security checks (SKILL.md, references/design-principles.md).
- [DYNAMIC_EXECUTION]: The skill generates and executes dynamic TypeScript/WebGL code for processing video frames. This functionality uses pre-defined EffectProcessor and TransitionProcessor templates. Execution is governed by constraints that block sensitive browser and Node.js globals such as fetch, eval, and require (references/design-principles.md). This is a functional requirement for the skill's primary purpose.
Audit Metadata