defold-core
Pass
Audited by Gen Agent Trust Hub on Nov 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the download of the Defold build tool (
bob.jar) and headless engine binaries from official and trusted sources, specifically the Defold GitHub repository and the vendor's dedicated archive domain. - [COMMAND_EXECUTION]: Instructs the agent to execute build commands using Java (
bob.jar) and to run generated game binaries under a timeout for smoke testing. It also uses a local Python script to perform project integrity checks. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: Reads and parses user-provided Defold project files, including configuration files (
game.project), collections, and Lua scripts. - Boundary markers: The skill does not explicitly define markers for separating project data from instructions, but it treats file content as data to be parsed for paths.
- Capability inventory: Employs shell commands to invoke the Java build system and execute the resulting compiled binaries.
- Sanitization: Validates project structure and resource paths using a dedicated Python script that performs read-only parsing.
Audit Metadata