asset-integration-workflow

Pass

Audited by Gen Agent Trust Hub on Mar 18, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: Employs standard Unix utilities such as grep, ls, mkdir, stat, and file to verify the existence of asset files and search for references within the source code. These actions are appropriate for the skill's stated purpose of asset management.
  • [EXTERNAL_DOWNLOADS]: References asset URLs from pixellab.ai, a known service for generating game assets. These references are documented as part of the asset loading process in game frameworks.
  • [REMOTE_CODE_EXECUTION]: Uses agent-browser eval to execute JavaScript commands in a browser context for testing and verifying game states. This is a standard automation pattern for UI and game integration testing.
  • [INDIRECT_PROMPT_INJECTION]: The workflow involves reading browser console logs and DOM states from a local development server, which represents a potential injection surface if the application under test contains untrusted data.
  • Ingestion points: agent-browser console output and agent-browser eval results (SKILL.md).
  • Boundary markers: None; no specific instructions are provided to the agent to treat browser data as untrusted.
  • Capability inventory: Local file system interaction (ls, mkdir, grep) and browser control (agent-browser).
  • Sanitization: None; the skill processes logs and states directly for verification purposes.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 18, 2026, 02:41 AM
Security Audit — agent-trust-hub — asset-integration-workflow