boardgame-io

Pass

Audited by Gen Agent Trust Hub on Sep 20, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The card game template contains a utility script assets/templates/card-game/scripts/gen-cards.sh which executes the apiz CLI tool. This is a vendor-provided tool used for AI image generation of card art and is a documented part of the skill's extended functionality.
  • [EXTERNAL_DOWNLOADS]: The image generation script gen-cards.sh utilizes curl to fetch resulting image assets from remote AI service endpoints to populate the game's assets folder.
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it ingests user-provided game requirements to generate executable code. However, it implements several mitigating factors including strict structural templates, enforced 'Golden Rules' for JSON-serializable state, and deterministic logic requirements that constrain the behavior of generated code.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 20, 2026, 09:02 AM