sd-combat-engine
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions suggest using a local script,
python scripts/validate_prompt.py, to verify prompt quality. This is presented as an internal quality control tool for the agent to validate its own output against project-specific safety and intensity standards (C21, C22) and does not involve executing arbitrary or remote code. - [INDIRECT_PROMPT_INJECTION]: The skill operates by processing user-provided combat scene descriptions. While this is an external data source, the skill implements rigorous internal 'Iron Laws' (combat-iron-laws.md) and multi-step validation processes (rhythm and intensity guardrails) that focus the agent strictly on cinematic prompt generation, effectively mitigating typical injection risks through strong structural constraints.
- [SAFE]: The skill is functionally dense and focuses entirely on cinematic prompt engineering. It does not utilize external network connections, reference untrusted remote resources, or attempt to access sensitive system files or credentials. All references are internal to the skill's own documentation and local scripts.
Audit Metadata