light-scene
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest and follow user-provided art direction briefs, references, and mockups, which serves as a potential vector for indirect instructions.
- Ingestion points: Artistic briefs, reference images, and mockups provided by the user in the 'Confirm art direction before implementation' and 'Choose the path from the brief' sections.
- Boundary markers: The instructions lack specific delimiters or system-level warnings to distinguish between the user's artistic intent and potential embedded instructions.
- Capability inventory: The skill uses tools such as
build-appto modify scene primitives andreuse-scripts/find-examplesto fetch and instantiate engine components. - Sanitization: No validation or sanitization process is described for the content of the art briefs before implementation.
- [EXTERNAL_DOWNLOADS]: The skill references external resources for graphics implementations.
- Evidence: Fetches rendering configurations and scripts from
playcanvas/scripts/esm/water.mjsandgraphics/water.example.mjs. - [DYNAMIC_EXECUTION]: The skill involves the dynamic instantiation of components at runtime.
- Evidence: Instructs the agent to import and create the
Watercomponent and construct theCameraFramehelper dynamically based on the selected rendering path.
Audit Metadata