minecraft-imagegen

Pass

Audited by Gen Agent Trust Hub on Sep 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes a bash utility script scripts/scaffold-asset-brief.sh used to generate markdown documentation for asset projects.
  • The script performs standard file system operations, including directory creation and writing asset templates.
  • It includes logic to automatically detect the project workspace environment to ensure files are saved in the correct context.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied asset metadata to generate prompts and documentation, which presents a standard but low-risk surface for indirect injection.
  • Ingestion points: User-provided strings for asset names, types, and style descriptions used in prompts and file generation.
  • Boundary markers: Absent in prompt templates, meaning the agent relies on its own instruction following to distinguish data from instructions.
  • Capability inventory: The skill uses a built-in image generation tool and writes local markdown files.
  • Sanitization: The scaffold-asset-brief.sh script actively sanitizes the name parameter using a whitelist regex ([^a-z0-9]+) before using it in a filename, preventing directory traversal or illegal character issues.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 18, 2026, 12:06 PM