game-dev-combat-skill-polish
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes Node.js scripts (
scripts/film.mjs,scripts/perf.mjs,scripts/probe.mjs) to automate gameplay capture by spawning browser processes viachild_process.spawn. This is a legitimate requirement for the headless filming workflow described in the documentation. - [INDIRECT_PROMPT_INJECTION]: The judging system involves sub-agents processing external data (captured images). The skill mitigates risks associated with processing untrusted content by providing strict instruction templates (
templates/judge-prompt.md) that limit the agents to specific files, forbid reading source code or keys, and enforce a rigid JSON output format. - [SAFE]: The skill demonstrates security awareness by instructing agents to avoid sensitive files and using anonymized IDs for the judging process. It follows standard practices for environment-based configuration and local file management. No evidence of obfuscation, data exfiltration, or persistence mechanisms was found.
Audit Metadata