shader-gen
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill identifies a potential indirect prompt injection surface through the ingestion of user prompts for shader generation. Ingestion points: The
promptparameter in thesubmit_shadertool. Boundary markers: The skill mandates a beta status warning and user confirmation before generation. Capability inventory: The agent uses tools likesubmit_shader,edit_item, andedit_asset. Sanitization: Backend validation is enforced alongside a runtime blocklist of hazardous globals such aseval,fetch, andprocess. - [COMMAND_EXECUTION]: The skill uses platform-specific tools including
browse_library,edit_item, andsubmit_shaderto interact with the project library and timeline. These tools are restricted to authorized video editing tasks and do not allow arbitrary system command execution. - [SAFE]: Security guidelines provided in the reference documentation establish a high-precision execution environment for WebGL effects, specifically prohibiting external communication and unauthorized dynamic code features. This proactive constraint prevents the generated code from performing malicious activities outside the video renderer.
Audit Metadata