minecraft-commands-scripting
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE]: The skill provides scripts for RCON administration that correctly avoid hardcoded credentials. It explicitly instructs the user to inject sensitive passwords via environment variables (e.g.,
MCRCON_PASS) rather than command-line arguments, which is a standard security best practice to prevent secret leakage in process lists or shell history. - [INDIRECT_PROMPT_INJECTION]: The skill establishes an ingestion surface for untrusted data by reading responses from a Minecraft server (such as player lists or chat logs). However, the provided scripts are designed for administrative output and do not pass this data back into the LLM context for automated execution, minimizing the risk of indirect prompt injection attacks.
- [COMMAND_EXECUTION]: The Bash and Python scripts use standard utilities (
mcrcon,rsync) for server maintenance and backups. The operations are local to the server environment and do not involve downloading or executing unverifiable remote code.
Audit Metadata