babylon-aaa-graphics-builder
Fail
Audited by Gen Agent Trust Hub on Aug 2, 2026
Risk Level: HIGHCREDENTIALS_UNSAFEDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill explicitly instructs the agent to 'run the credential probe' to check for the presence of API keys (KEY=SET|MISSING), which is a pattern designed to discover and verify sensitive environmental secrets.\n- [DATA_EXFILTRATION]: The workflow requires the agent to 'paste' the output of the credential probe into the final response via the 'external asset sourcing ledger', resulting in the exfiltration of sensitive configuration state.\n- [PROMPT_INJECTION]: The instructions use coercive logic, declaring that procedural-only results are 'not a valid final answer' unless the agent provides probe output, which is intended to override default safety constraints regarding secret discovery.\n- [PROMPT_INJECTION]: The skill processes untrusted data from 'active-play screenshots' and 'visual-scorecard.md' to determine visual scores without implementing boundary markers or sanitization. Ingestion points: visual-scorecard.md, user-provided screenshots. Boundary markers: Absent. Capability inventory: Loading and executing external generator skills (threejs-3d-generator, babylon-image-generator). Sanitization: Absent.
Recommendations
- AI detected serious security threats
Audit Metadata