game-tools-workflows

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides a Python class in SKILL.md designed to automate Unity game builds via the command line.
  • Evidence: The code utilizes subprocess.run(args, capture_output=True) to execute the Unity binary.
  • The implementation follows security best practices by passing arguments as a list rather than a single string, which effectively prevents shell injection vulnerabilities.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines a metadata schema that ingests parameters that could potentially influence agent behavior.
  • Ingestion points: The YAML frontmatter in SKILL.md defines workflow and team_size parameters.
  • Boundary markers: The skill uses enum validation within the YAML configuration to restrict these parameters to a fixed set of safe values, preventing the injection of arbitrary instructions.
  • Capability inventory: The skill has the capability to execute external commands and manage files as part of its build automation purpose.
  • Sanitization: Input validation is handled at the platform level via the parameter enums defined in the skill manifest.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 05:15 PM
Security Audit — agent-trust-hub — game-tools-workflows