web-game-assets
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/assets.mjsfile executes theffmpegcommand-line tool to perform audio compression. The execution is limited to audio processing tasks with controlled arguments. - [DYNAMIC_EXECUTION]: The pipeline script uses dynamic
import()calls to load optional dependencies from the project's localnode_modulesdirectory, such as@gltf-transformpackages andmeshoptimizer. - [EXTERNAL_DOWNLOADS]: The skill references several well-known third-party asset libraries (e.g., Kenney, Poly Haven, OpenGameArt) for the user to obtain game assets.
- [INDIRECT_PROMPT_INJECTION]: Surface detected where skill processes external asset data. 1. Ingestion points: Reads files from
assets-src/directory. 2. Boundary markers: None. 3. Capability inventory: File system read/write/delete (fs), command execution (ffmpeg). 4. Sanitization: Filters by file extension and validates glTF structure before processing.
Audit Metadata