create-item
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands using
npxandnodeto manage Minecraft content and metadata. - [EXTERNAL_DOWNLOADS]: The skill fetches vanilla assets from the
Mojang/bedrock-samplesGitHub repository. - [REMOTE_CODE_EXECUTION]: The skill uses
npxto download and execute the@minecraft/creator-toolspackage from the NPM registry. As these tools are provided by the official vendor, this is a standard operational practice. - [INDIRECT_PROMPT_INJECTION]: The skill processes user descriptions to generate item definitions and script arguments. Ingestion points include user requests for new items (e.g., 'plain description'). No explicit boundary markers or instructions to ignore embedded instructions are documented. The capability inventory includes file system modifications and shell command execution using the
npxandnodebinaries. No explicit sanitization or validation of user-provided content is mentioned before use in command arguments.
Audit Metadata