skills/egorfedorov/slot-casino-game-developer-skills-for-stake-engine/turbo-spin-designer/Gen Agent Trust Hub
turbo-spin-designer
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external JSON specification files, which creates a potential surface for indirect prompt injection.
- Ingestion points: The skill ingests content from user-provided files via the
--inputflag in the validation script (scripts/validate_turbo_spin_spec.py) and through agent interaction with the specification documents. - Boundary markers: There are no explicit delimiters or instructions within the skill to differentiate data from instructions within the ingested specification files.
- Capability inventory: The skill includes a Python script that reads and parses JSON files, and the agent uses the parsed data to generate design documentation, state maps, and sign-off templates.
- Sanitization: The validation script checks for schema compliance (required fields and data types) but does not sanitize string values for potential malicious prompt instructions.
Audit Metadata