eval-driven-game-development
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructions involve processing potentially untrusted external data, including game source code, project documentation, and simulation manifests.
- Ingestion points: Ingests game source code (via grep) as noted in
SKILL.md, and configuration manifests or event logs as described inreferences/harness.md. - Boundary markers: No explicit delimiters or instructions for isolating untrusted data during prompt interpolation are provided.
- Capability inventory: Describes the use of shell command execution for balance runners and file-system search operations (grep).
- Sanitization: No mention of sanitizing or validating the content of the external files before processing.
- [EXTERNAL_DOWNLOADS]: The skill's CI/CD documentation in
references/harness.mdincludes references to official GitHub Actions. - Evidence: The nightly and PR-tier CI recipes fetch
actions/checkout@v4andactions/upload-artifact@v4from GitHub's official repository infrastructure for standard build and reporting workflows.
Audit Metadata