jgengine-verify
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies extensively on executing local CLI tools via
bun runandnpxfor developer workflows. This includes running unit tests (bun test), capturing screenshots (bun run shoot), driving gameplay (bun run drive), and performance profiling (bun run perf). - [EXTERNAL_DOWNLOADS]: The verification process may involve linking or downloading game assets such as 3D models and textures from a shared asset store during local development or CI runs.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and verify game engine data, including scene files (
editor.scene.json), console logs, and performance metrics (debug_snapshot). This represents a potential attack surface where untrusted data enters the agent's context. The skill uses structured data interfaces (likewindow.__jgengineAgent) to mitigate risks, but the ingestion of arbitrary scene content is noted.
Audit Metadata