create-item

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONREMOTE_CODE_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes shell commands using npx and node to manage Minecraft content and metadata.
  • [EXTERNAL_DOWNLOADS]: The skill fetches vanilla assets from the Mojang/bedrock-samples GitHub repository.
  • [REMOTE_CODE_EXECUTION]: The skill uses npx to download and execute the @minecraft/creator-tools package from the NPM registry. As these tools are provided by the official vendor, this is a standard operational practice.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user descriptions to generate item definitions and script arguments. Ingestion points include user requests for new items (e.g., 'plain description'). No explicit boundary markers or instructions to ignore embedded instructions are documented. The capability inventory includes file system modifications and shell command execution using the npx and node binaries. No explicit sanitization or validation of user-provided content is mentioned before use in command arguments.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 01:14 PM