love2d
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill provides implementation patterns for dynamic code execution using the Lua load function.
- Specifically, the Bytecode pattern in references/love2d-pattern-mappings.md demonstrates how to compile and execute string-based formulas at runtime.
- While a common practice in game development for modding and data-driven logic, this mechanism allows for arbitrary code execution within the Lua environment.
- [INDIRECT_PROMPT_INJECTION]: The inclusion of dynamic execution patterns creates a surface for indirect prompt injection if the agent generates code that processes untrusted external data.
- Ingestion points: Untrusted data enters the agent context through the formula_str parameter in the eval_formula function defined in references/love2d-pattern-mappings.md.
- Boundary markers: The skill does not provide specific boundary markers or delimiters for the load function input in the provided examples.
- Capability inventory: The skill documents the use of load() which enables full script execution capabilities.
- Sanitization: The skill includes a clear security warning advising developers to never load strings from untrusted sources and to use restricted environments or dedicated scripting libraries for mod support.
Audit Metadata