defold-project-build
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill automates project builds by communicating with the Defold editor's local HTTP API. All network activity is restricted to the local loopback address (127.0.0.1).
- [INDIRECT_PROMPT_INJECTION]: The skill processes output from the Defold editor, creating a surface for potential instruction injection via project source code or build errors.
- Ingestion points: Responses from the
/command/buildand/consoleendpoints (SKILL.md). - Boundary markers: None. The skill does not instruct the agent to treat editor output as untrusted data or use delimiters.
- Capability inventory: Network requests to localhost via
curlandInvoke-RestMethod, and local file system access to.internal/editor.port. - Sanitization: None. The content retrieved from the editor is processed directly.
Audit Metadata