s-develop
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The instructions and code samples follow established best practices for World of Warcraft addon development, focusing on testability and API resilience. The mentioned 'secret values' refer to internal Blizzard game engine userdata types used for data protection during combat, rather than user credentials.
- [INDIRECT_PROMPT_INJECTION]: The skill documents patterns for handling external game data such as chat messages (
CHAT_MSG_*) and unit information, which constitutes an ingestion surface for untrusted data at runtime. - Ingestion points: Data enters the addon context through events like
CHAT_MSG_*and unit-querying APIs as described inreferences/event-patterns.mdandreferences/api-patterns.md. - Boundary markers: None identified for runtime data; the guide focuses on standard game API defensive programming like nil checks and feature detection.
- Capability inventory: The skill leverages MCP tools including
addon.sync(filesystem junctions) andlibs.sync(library management) for project workflows. - Sanitization: No specific sanitization or filtering logic is described for the ingestion of external game strings, as they are primarily handled within the game's Lua sandbox.
Audit Metadata