smoke-check
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the Bash tool to execute local shell commands for running engine-specific test suites (Godot) and identifying log files (Unity, Unreal). These operations are part of the intended project-internal testing workflow.
- [INDIRECT_PROMPT_INJECTION]: The skill identifies a surface where instructions could be embedded in ingested project data.
- Ingestion points: Reads from production/qa/qa-plan-*.md, .claude/docs/technical-preferences.md, and sprint plan documents.
- Capability inventory: Access to Bash (shell execution) and Write (file system modification).
- Boundary markers: No explicit delimiters or instructions to ignore embedded commands are used when reading these files.
- Sanitization: No evidence of input validation or content sanitization was found for the ingested files.
Audit Metadata