game-ui-product-design
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a project initialization script
scripts/init_project.pyusing a user-supplied<project-id>as a command-line argument. This execution pattern involves passing unverified input to a shell command.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external files to generate core project documentation, creating a vulnerability surface.\n - Ingestion points: The skill reads from user-provided files
spec.md,research.md, andplan.md.\n - Boundary markers: There are no explicit delimiters or instructions to ignore potential commands embedded in these input files.\n
- Capability inventory: The skill is capable of writing files to the
specs/directory and executing a local Python script.\n - Sanitization: No sanitization or validation of the input file content is performed.
Audit Metadata