boardgame-io
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The card game template contains a utility script
assets/templates/card-game/scripts/gen-cards.shwhich executes theapizCLI tool. This is a vendor-provided tool used for AI image generation of card art and is a documented part of the skill's extended functionality. - [EXTERNAL_DOWNLOADS]: The image generation script
gen-cards.shutilizescurlto fetch resulting image assets from remote AI service endpoints to populate the game's assets folder. - [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it ingests user-provided game requirements to generate executable code. However, it implements several mitigating factors including strict structural templates, enforced 'Golden Rules' for JSON-serializable state, and deterministic logic requirements that constrain the behavior of generated code.
Audit Metadata