defold-core
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the Defold build tool (
bob.jar) and headless engine binaries from official Defold domains (github.com/defoldandd.defold.com) for project compilation and automated testing. - [COMMAND_EXECUTION]: Utilizes Java (
java -jar bob.jar) to build project assets and executes a locally provided Python script (scripts/check_defold_project.py) to verify resource integrity. It also executes the resulting game binary in a headless environment for smoke testing. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill reads project configuration (
game.project), collection structures, and Lua scripts to perform builds and checks. - Boundary markers: Absent; the skill relies on the structured nature of Defold protobuf and INI files.
- Capability inventory: Includes subprocess execution for Java, Python, and the generated game binary.
- Sanitization: The
check_defold_project.pyscript performs read-only static analysis using regular expressions and path validation without executing the content of the analyzed files.
Audit Metadata