shader-gen

Pass

Audited by Gen Agent Trust Hub on Aug 19, 2026

Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [PROMPT_INJECTION]: The skill identifies a potential indirect prompt injection surface through the ingestion of user prompts for shader generation. Ingestion points: The prompt parameter in the submit_shader tool. Boundary markers: The skill mandates a beta status warning and user confirmation before generation. Capability inventory: The agent uses tools like submit_shader, edit_item, and edit_asset. Sanitization: Backend validation is enforced alongside a runtime blocklist of hazardous globals such as eval, fetch, and process.
  • [COMMAND_EXECUTION]: The skill uses platform-specific tools including browse_library, edit_item, and submit_shader to interact with the project library and timeline. These tools are restricted to authorized video editing tasks and do not allow arbitrary system command execution.
  • [SAFE]: Security guidelines provided in the reference documentation establish a high-precision execution environment for WebGL effects, specifically prohibiting external communication and unauthorized dynamic code features. This proactive constraint prevents the generated code from performing malicious activities outside the video renderer.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 19, 2026, 12:00 AM
Security Audit — agent-trust-hub — shader-gen