gamemaker-expert
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze GameMaker project files (.gml, .yy, .yyp), which presents an inherent surface for indirect prompt injection if those files contain instructions targeting the AI agent.
- Ingestion points: Automatically processes GameMaker source files and project metadata as defined in SKILL.md.
- Boundary markers: No explicit instructions are provided to the agent to differentiate between user-provided code and its own internal system prompts.
- Capability inventory: The skill provides architectural and implementation guidance for file operations, network requests, and external script execution.
- Sanitization: The skill does not instruct the agent to sanitize project data or identifiers before processing.
- [DYNAMIC_EXECUTION]: The documentation includes instructions for standard GML features that involve dynamic code assembly and execution, which are essential for certain game features but represent a high-capability surface.
references/ADVANCED_TOPICS.mddocuments the use ofhtml5_run_script()for executing arbitrary JavaScript in web-based games.references/ADVANCED_TOPICS.mddocuments the use ofregistry_write_string()for modifying Windows registry keys, typically for game configuration.references/COMMON_PITFALLS.mdrecommends the use of thepython -m json.toolCLI command for validating JSON assets within the development environment.
Audit Metadata