add-assets
Pass
Audited by Gen Agent Trust Hub on Apr 22, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXFILTRATION]: The skill reads local project configuration and source code files, such as package.json and files within src/, to extract entity definitions. This access is confined to the provided project path and no network exfiltration was found.- [COMMAND_EXECUTION]: The skill instructs the agent to execute npm run build and recommends using an internal QA tool (/game-creator:qa-game) to verify the visual changes in the game.- [PROMPT_INJECTION]: The skill processes source code from the user's project, creating a surface for indirect prompt injection. Ingestion points: package.json, src/core/Constants.js, and src/entities/*.js. Boundary markers: None. Capability inventory: Writing new files to the src/ directory and executing build commands. Sanitization: None. This risk is inherent to the skill's primary purpose of automated code modification.
Audit Metadata