skills/egorfedorov/slot-casino-game-developer-skills-for-stake-engine/senior-game-math-engineer/Gen Agent Trust Hub
senior-game-math-engineer
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions in
SKILL.mdexplicitly direct the agent to execute local Python and Shell scripts (e.g.,Engine/scripts/verify_rtp.py,games/Darumas/verify_math.sh, andgames/Darumas/test_rtp_check.sh) to perform math audits. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface where untrusted data could influence agent actions through command injection.
- Ingestion points: External data enters the context via the 'Capture target spec' step in
SKILL.md, includinggame_id, mode lists, and target RTP metrics. - Boundary markers: There are no explicit boundary markers or instructions to treat the ingested game specifications as untrusted data or to disregard instructions embedded within them.
- Capability inventory: The skill allows for local shell command execution using
python3andbashas defined in the 'Project Commands' section ofSKILL.md. - Sanitization: The skill lacks sanitization instructions for the
<game_id>parameter or other specification values before they are interpolated into shell commands, creating a risk of command injection.
Audit Metadata