worldview-game-high-fidelity-vertical-slice
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill promotes secure handling of sensitive data, explicitly stating that secrets should never enter project files or commits and warning users not to paste credentials into prompts.
- [SAFE]: The skill manages external capabilities (Blender MCP, image APIs) using a ledger system that requires authorization, scope definition, and cost boundaries before usage, which aligns with the principle of least privilege.
- [INDIRECT_PROMPT_INJECTION]: The skill has a standard attack surface for a creative agent, as it ingests untrusted user creative briefs to drive generation.
- Ingestion points: Creative briefs and story premises provided by the user in SKILL.md and README.md.
- Boundary markers: The skill instructs the agent to maintain a 'Source boundary' and 'Lock register' (see templates/vertical-slice-contract.md) to differentiate between user proposals and established project facts.
- Capability inventory: The agent has access to file system read/write operations, browser/engine automation, and DCC (Digital Content Creation) scripting interfaces.
- Sanitization: No specific input sanitization is implemented for the story text, but the structured 'Lock' methodology mitigates the risk of accidental instruction override by requiring verification against established project constraints.
Audit Metadata