test-locomotion

Pass

Audited by Gen Agent Trust Hub on Oct 2, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • Command Execution: The skill uses the iwsdk CLI to perform actions like reloading the browser, entering XR mode, and setting gamepad states. These are necessary for the skill's primary purpose of locomotion testing and occur within the developer's local environment.
  • External Downloads: Setup steps involve running npm run fresh:install, which downloads project dependencies. This is a common practice in development environments to ensure the necessary libraries are present for the application to run.
  • Indirect Prompt Injection Surface: The instructions require the agent to parse JSON output from tools and use the extracted values (such as entity indices) in subsequent commands. This creates a point where external data enters the agent's context, though in this use case, the data originates from the tool's own status reports within the local workspace.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 2, 2026, 07:29 PM