fivemanage
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download the Fivemanage SDK and the
screenshot-basicprerequisite from their official GitHub repositories as part of the installation process. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the game environment, such as player chat messages and custom metadata, which is then processed by the logging and image upload systems.
- Ingestion points: External data is ingested through the
exports.fmsdk:Log,exports.fmsdk:Info/Warn/Error, andexports.fmsdk:takeImagefunctions, as well as automatic chat and player event logging configured inconfig.json(documented inSKILL.mdandrules/logs.md). - Boundary markers: There are no explicit instructions or delimiters defined to prevent the AI or the SDK from processing potentially malicious commands embedded within logs or metadata.
- Capability inventory: The skill utilizes network operations to transmit captured images and log entries to the Fivemanage API dashboard.
- Sanitization: The skill instructions do not specify sanitization or filtering procedures for the ingested external content before it is interpolated into log messages or metadata fields.
Audit Metadata