design-game
Pass
Audited by Gen Agent Trust Hub on Apr 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill performs project verification by executing the
npm run buildcommand after modifications are applied to the game source. - [PROMPT_INJECTION]: The skill reads and processes external project files, which creates an attack surface for indirect prompt injection.
- Ingestion points: The skill reads
package.json,src/core/Constants.js, scene files, entity files, andsrc/core/EventBus.jsfrom the target project directory. - Boundary markers: No specific markers or delimiters are used in the instructions to separate audited file content from the agent's instructions.
- Capability inventory: The skill has the capability to write modifications to the file system (modifying
Constants.jsand creating new files) and execute shell commands (npm run build). - Sanitization: There is no explicit sanitization or validation of the content read from the project files before it is processed by the model.
Audit Metadata